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Preface 

The  initial  draft  of  this  report  was  prepared  based  on  analysis  of  the  national-level 
articulations  of  strategy  proceeding  from  the  terrorist  events  of  September  1 1 ,  200 1 . 
Consequently,  the  concept  of  homeland  security  that  underpinned  this  report’s  initial 
presentation  of  the  homeland  security  mission  was  terrorism-centric  and  distinct  from 
activities  required  to  1)  protect  American  lives  and  property  from  major  natural  disasters 
and  accidents  and  2)  respond  to  and  recover  from  the  consequences  of  those  events. 

The  concept  of  homeland  security  has  continued  to  evolve,  shaped  in  no  small  part  by  the 
magnitude  of  natural  disasters  that  occurred  in  2005.  Subsequent  to  the  completion  of  the 
initial  draft  of  this  report,  the  homeland  security  mission  area  analysis  was  refined 
through  a  collaborative  effort  involving  the  Homeland  Security  Institute  and  the 
Department  of  Homeland  Security’s  Grants  &  Training  and  Science  &  Technology 
directorates.  This  process  deliberately  employed  a  revised  concept  of  homeland  security 
that  is  all-hazards  in  scope,  integrating  activities  previously  subsumed  under  the  rubric  of 
national  preparedness.  The  results  of  the  subsequent  mission  area  analysis  now  known  as 
the  All-Hazards  Taxonomy  is  contained  in  the  addendum  to  this  report.  This  work  will 
undoubtedly  continue  to  be  refined  as  understanding  of  the  homeland  security  mission 
deepens  with  time,  experience,  and  study. 
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Executive  Summary 

This  report  documents  the  homeland  security  (HS)  mission  area  analysis  (MAA) 
conducted  by  the  Homeland  Security  Institute  (HSI). 

The  HS  MAA  identifies  the  activities  required  to  conduct  the  missions  identified  in  the 
National  Strategy  for  Homeland  Security  (NSHS).  Accordingly,  the  HS  MAA  focuses 
specifically  on  the  NSHS  missions  without  regard  for  organizational  or  jurisdictional 
boundaries,  either  inside  or  outside  the  federal  government.  Nevertheless,  the  HSI  study 
team  recognizes  that  many  related  planning  efforts  are  underway  within  the  Department 
of  Homeland  Security  (DHS)  and  other  organizations.  Wherever  possible,  HSI  has 
attempted  to  identify  and  incoiporate  these  other  efforts,  to  ensure  that  the  perspectives  of 
all  stakeholders  are  considered. 

In  developing  the  MAA,  HSI  conducted  a  detailed  analysis  of  national  guidance 
documents,  decomposing  them  into  discrete  activities  related  to  the  NSHS  missions 
across  the  national  scope  of  HS  operations.  The  HSI  analysis  also  identified  a  set  of 
common  tasks  that  enable  all  functions  within  the  HS  MAA.  These  common  tasks  are 
those  performed/managed  not  only  by  DHS,  but  by  all  organizations  responsible  for 
securing  the  homeland.  Internal  (HSI)  and  external  reviews  as  well  as  HS-community 
outreach  further  refined  the  MAA. 

The  MAA  hierarchy  includes  five  levels:  Goals,  Missions,  Objectives,  Functions,  and 
function-specific  Tasks.  These  describe  the  HS  operational  mission  space  with  sufficient 
granularity  to  enable  the  MAA  to  serve  as  an  effective  analysis  and  measurement  tool. 
HSI  facilitated  a  series  of  four  collaborative  interagency  workshops  to  review  straw  man 
Objectives  and  Functions  and  to  develop  lists  of  Tasks  associated  with  each  HS  Function. 
A  broad  range  of  HS  partners  participated  in  each  workshop,  including  representatives 
from  federal,  state,  and  local  government  organizations.  Workshop  participants  provided 
valuable  insights  and  observations  regarding  the  elements  of  the  MAA  and  their 
definitions. 

The  resulting  MAA  provides  a  logical  structure  for  analyzing  and  measuring  NSHS- 
derived  mission  outcomes.  The  HSI  study  team  recommends  that  the  MAA  elements  be 
prioritized  and  that  their  framework  guide  the  Department’s  analysis  of  homeland 
security  operational  capabilities,  needs,  and  gaps. 
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1.0  Introduction 

1.1  Purpose 

This  report  explains  the  approach  used  by  the  Homeland  Security  Institute  (HSI)  to 
conduct  the  homeland  security  (HS)  mission  area  analysis  (MAA).  It  also  documents  the 
results  of  that  analysis. 

1.2  Scope 

The  National  Strategy  for  Homeland  Security  (NSHS)  provides  a  clear  presentation  of 
national  leadership’s  strategic  vision  for  homeland  security  involving  stakeholders  in 
federal,  state,  local,  and  tribal  governments  as  well  as  the  private  sector.  As  defined  by 
the  NSHS,  homeland  security  is  a  concerted  effort  to  “prevent  terrorist  attacks  within  the 
United  States,  reduce  America’s  vulnerability  to  terrorism,  and  minimize  the  damage  and 
recover  from  attacks  that  do  occur.”1 

The  HS  MAA  provides  a  hierarchical  breakdown  of  the  activities  required  to  achieve  this 
goal  (Figure  1).  These  activities  include  the  objectives,  functions,  and  tasks  specified  for 
the  missions  identified  in  the  NSHS.  These  five  categories  of  activities  describe  the  HS 
operational  mission  space  with  sufficient  clarity  to  enable  the  MAA  to  be  an  effective 
analysis  and  measurement  tool.  Collectively,  the  five  MAA  categories  tell  what  must  be 
done  to  secure  the  homeland. 
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Figure  1.  MAA  Hierarchy — What  Are  the  Right  Objectives,  Functions,  and  Tasks? 

The  hierarchy  establishes  a  logical  relationship  among  these  activities,  as  shown  in 
Figure  2.  A  given  activity  can  be  thought  of  as  a  “what.”  The  hierarchy  successively 
decomposes  each  “what”  into  subordinate  activities  at  the  next  lower  level  that  tells 
“how.”  When  the  decomposition  is  complete,  the  hierarchy  can  be  traced  both 
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downwards — decomposing  successive  “whats”  into  “hows,”  and  upwards — each  activity 
supporting  the  accomplishment  of  a  higher  level  outcome  and  answering  the  question 
“why.” 


What 

c 

How 


Why 

What 


Figure  2.  Hierarchy  Establishes  Logical  Relationships 

The  MAA  covers  all  NSHS  missions  required  to  secure  the  homeland  from  terrorism, 
regardless  of  organizational  and  jurisdictional  restrictions.  Any  one  agency  or 
organization  cannot  independently  secure  the  homeland.  Achieving  that  goal  involves  all 
levels  of  federal,  state,  local,  and  tribal  governments  as  well  as  a  variety  of  private 
organizations — each  performing  vital  HS  activities.  Thus,  the  HS  MAA  provides  a 
unifying  framework  for  identifying  and  coordinating  all  governmental  and  private  HS 
mission  operations,  not  just  those  performed  by  DHS. 

Within  the  federal  government,  DHS  has  primary  responsibility  for  the  majority  of  the 
HS  mission.  However,  the  Department’s  responsibilities  do  not  cover  the  entire  space. 
Conversely,  not  all  of  DHS’s  activities  are  related  directly  to  the  HS  mission  (e.g., 
preparedness  for  natural  disasters  and  accidents).  The  logical  relationship  between 
homeland  security  (which  is  taken  by  this  report  to  be  terrorism-centric),  National 
Preparedness  (against  all  hazards),  and  the  mission  of  DHS  is  shown  in  Figure  3. 


Figure  3:  Homeland  Security,  National  Preparedness,  and  the  mission  of  DHS 

The  HSI  study  team  identified  several  related  planning  efforts  within  DHS.  Two  notable 
examples  are  the  development  of  the  Universal  Task  List  (UTL)  under  Homeland 
Security  Presidential  Directive-8  (HSPD-8),  National  Preparedness,  and  the  development 
of  the  National  Infrastucture  Protection  Plan  (NIPP)  under  HSPD-7,  Critical 
Infrastructure  Identification,  Prioritization,  and  Protection.  Wherever  possible,  HSI 
worked  closely  with  the  DHS  elements  conducting  these  efforts. 
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1.3  Background 

HSI  is  tasked  by  its  DHS  Sponsor  to  help  develop  and  implement  a  capabilities-based 
planning  process  “that  integrates  strategic  planning  with  activities  such  as  threat  and 
vulnerability  assessment,  mission  analysis,  risk  assessment,  investment  strategy 
development,  resource  allocation,  program  planning  performance-based  assessment,  and 
system  requirements  analysis.”  The  results  should  “[Help]  the  Department  weigh  its 
options  for  ‘where  the  next. .  .dollar’  should  be  spent.”2  To  accomplish  this  task,  HSI 
outlined  a  prototype  approach  involving  three  steps: 

1 .  Strategic  Prioritization 

2.  Systems  Analysis  and  Architecture 

3.  Portfolio  Management  and  Programming 

These  steps  also  complement  ongoing  DHS  efforts  such  as  HSPD-8  initiatives  that  are 
implementing  1)  a  national  domestic  preparedness  goal;  2)  mechanisms  for  improved 
delivery  of  federal  preparedness  assistance  to  state  and  local  governments;  and  3)  actions 
to  strengthen  preparedness  capabilities  of  federal,  state,  and  local  entities.  A 
comprehensive  capabilities-based  process  for  weighing  investment  options  is  required  to 
optimize  mission  preparedness  among  all  homeland  security  partners. 

Within  this  context,  the  HS  MAA  provides  a  comprehensive  understanding  of  the  HS 
mission  and  thus  a  foundation  for  the  capabilities-based  planning  process.  Decomposing 
HS  missions  into  their  constituent  objectives,  functions,  and  tasks  provides  planners  with 
a  framework  to  use  in  identifying  shortfalls  and  redundancies,  thus  helping  to  guide 
resource  allocation  decisions. 


2  Homeland  Security  Institute,  Research  Plan,  FY05,  Tasks  05  and  06. 
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2.0  Methodology 

2.1  MAA  Hierarchy 

The  MAA  hierarchy  was  initially  constructed  by  analyzing  national  guidance  documents 
(e.g.,  legislation,  Homeland  Security  Presidential  Directives,  National  Security 
Presidential  Directives,  the  NSHS,  the  Department  of  Homeland  Security  Strategic  Plan, 
and  the  National  Response  Plan). 

The  NSHS  provides  the  goal:  “to  prevent  terrorist  attacks  within  the  United  States,  reduce 
America’s  vulnerability  to  terrorism,  and  minimize  the  damage  and  recover  from  attacks 
that  do  occur.”3  From  this  broad  starting  point,  the  elements  of  the  MAA  hierarchy  flow 
downward  in  scale  and  specificity. 

To  identify  the  activities  in  the  hierarchy,  the  study  team  parsed  the  national  guidance 
documents  into  discrete  functional  statements.  These  activities  are  represented  on  the 
MAA  hierarchy;  their  titles  and  their  definitions  contain  language  taken  directly  from  the 
guidance  documents. 

The  team  organized  these  activities  in  a  hierarchy,  based  on  their  scope  and  scale.  The 
initial  HS  MAA  hierarchy  consisted  of  four  levels:  Goal,  Mission,  Objective,  and 
Function.  Each  element  at  a  given  level  (for  example,  each  Function)  is  similar  in  scale. 
Moreover,  each  element  represents  a  discrete  activity  that  does  not  overlap  with  other 
activities.  Finally,  the  elements  of  the  hierarchy  are  arranged  according  to  parent-child 
relationships;  that  is,  each  parent  element  is  decomposed  into  its  children.  The  fulfillment 
of  the  child  elements  constitutes  the  fulfillment  of  the  parent  element. 

To  refine  the  initial  draft,  HSI  leveraged  available  subject  matter  expertise.  The  study 
team  conducted  informal  interviews  of  staff  from  across  HSI,  as  well  as  formal  reviews 
within  the  Institute.  The  team  also  tapped  external  sources,  including  institutional 
outreach  partners  and  federal  government  personnel.  The  task  development  process  (see 
next  section)  provided  an  opportunity  for  personnel  from  several  federal  agencies,  state 
and  local  governments,  and  the  private  sector  to  review  and  comment  on  the  MAA 
Objectives  and  Functions. 

2.2  Task  Development 

Tasks  reside  at  a  level  below  MAA  Functions.  Tasks  in  the  MAA  are  divided  into  two 
types:  Common  Tasks  and  Function-Specific  Tasks. 

Common  Tasks  are  those  tasks  associated  with  Preparedness,  Resource  Management, 
Communications  and  Information  Management,  and  Supporting  Technology  (see  Figure 
1).  They  enable  all  Functions  and  therefore  are  not  included  in  the  list  of  Tasks  associated 
with  each  specific  Function.  The  Tasks  in  this  category  are  derived  from  national 
guidance  documents.  These  Common  Tasks  occur  across  the  entire  operational  mission 


3  National  Strategy  for  Homeland  Security,  2. 
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space.  They  not  only  occur  within  each  MAA  function  but  also  within  homeland  security 
partner  organizations  carrying  out  NSHS  missions.  The  definitions  of  these  Common 
Tasks  are  provided  in  Appendix  B. 

Function- Specific  Tasks  are  basic  discrete  FIS  activities  organized  into  particular  sets  that 
enable  individuals  and  organizations  to  accomplish  specific  MAA  Functions.  These 
Tasks  were  identified  in  a  series  of  four  collaborative  interagency  Task  Development 
Workshops  facilitated  by  HSI.  These  workshops  produced  a  set  of  Function-Specific 
Tasks  and  their  respective  definitions  for  each  MAA  Function  (see  section  3.0,  Results). 
The  workshops  used  existing  products  including  the  foundational  work  of  the  UTL  to 
develop  the  full  spectrum  of  FIS  tasks.  A  broad  range  of  FIS  partners  participated  in  each 
workshop,  including  representatives  from  federal,  state,  and  local  government 
organizations. 

The  following  FIS  MAA  Task  Development  Workshops  were  conducted: 

•  March  16:  Intelligence 

•  April  14:  Law  Enforcement/Border-Transportation  Security 

•  April  19:  Critical  Infrastructure  Protection 

•  April  29  [virtual]:  Respond  and  Recover 

The  first  three  workshops  were  one-day  sessions  facilitated  by  the  HSI  study  team.  The 
final  workshop,  Respond  and  Recover,  used  existing  working  groups  of  the  Office  for 
State  and  Local  Government  Coordination  and  Preparedness.  HSI  provided  draft 
Respond  and  Recover  Task  lists  to  the  working  groups,  who  then  provided  their 
recommendations  electronically. 

Before  the  workshops,  the  HSI  study  team  developed  straw  man  tasks  and  definitions, 
based  on  the  UTL  and  other  sources.  HSI  provided  the  straw  man  task  list  to  the 
participants,  along  with  other  background  materials  including  a  list  of  eight  threat 
families  (Chemical,  Biological,  Radiological,  Nuclear,  Explosives,  Cyber,  Assault,  and 
Emerging);  and  a  generic  adversary  pathway  (Decide,  Deploy,  Plan,  Employ,  Acquire, 
Escape). 

During  the  workshops,  participants  provided  insights  and  observations  on  the  MAA 
Objectives  and  Functions.  They  then  discussed  the  straw  man  HS  Task  titles  and 
definitions,  and  adopted  revised  language  for  them  based  on  cross-functional  subject- 
matter  expertise. 
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Figure  4.  Task  Development  Workshop  Process 


Figure  4  illustrates  the  workshop  process  in  greater  detail.  In  Phase  1  of  the  process, 
participants  examined  the  straw  man  HS  Task  lists  for  comprehensiveness  and  relevance. 
This  assessment  was  set  in  the  context  of  organizational  responsibilities  as  well  as  the 
threat  types  and  pathways  provided  earlier.  In  addition,  participants  were  encouraged  to 
discuss  Function  titles  associated  with  the  relevant  Objectives  specified  in  the  HS  MAA. 
Phase  2  required  participants  to  develop  new  Tasks  as  required.  Phase  3  required 
participants  to  review  and  clarify  all  current  Task  definitions.  In  Phase  4,  participants 
developed  definitions  for  all  added  Tasks. 

After  the  workshops,  the  HSI  team  reviewed  and  incoiporated  the  inputs  and  provided 
participants  with  a  revised  set  of  Objectives,  Functions,  and  Tasks.  This  step  allowed 
participants  to  see  the  results  of  their  collective  efforts  and  offer  any  additional 
insights/suggestions.  Appendix  A  details  all  such  post-workshop  participant  commentary. 
The  HSI  team  analyzed  each  comment  and  decided  whether  it  should  be  accepted, 
rejected,  or  modified  and  incorporated.  Appendix  A  includes  the  decisions  made  by  HSI 
analysts  as  well  as  their  rationale  for  each  decision. 
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3.0  Results 

This  section  describes  the  results  of  interagency  Task  Development  Workshops.  These 
results  include  the  four  levels  (Missions,  Objectives,  Functions,  and  Functions- Specific 
Tasks)  under  the  overall  Goal  (Secure  the  Homeland)  of  the  HSI  MAA  hierarchy  shown 
on  the  next  page  (Figure  5).  These  results  are  organized  as  follows: 

•  The  definitions  for  each  of  the  four  levels 

•  A  series  of  tables  for  each  Mission  and  Objective  defining  its  Functions  and 
(Function-Specific)  Tasks. 
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Note  1:  Common  Tasks  occur  across  all  Functions:  (A)  Planning  and  Coordination,  (B)  Preparedness,  (C)  Resource  Management, 
(D)  Communications  &  Information  Management,  (E)  Supporting  Technology. 

Note  2:  Function-Specific  Tasks  enable  the  function  to  be  performed. 

Figure  5.  HSI MAA  Hierarchy,  Post- Workshops  Version 
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Mission:  Prevent 

Deter  all  potential  terrorists  from  attacking  America,  detect  terrorists  before  they  strike, 
prevent  them  and  their  instruments  of  terror  from  entering  our  country,  and  eliminate  the 
threat  they  pose. 


Objective:  Detect  Threats 


Identify,  assess,  and  communicate  real  and/or  potential 
threats  in  order  to  preempt  and  prevent  attacks 


Conduct  strategic  planning  and  direct  intelligence  activities 


Gather  raw  data  from  which  information  and  intelligence 
will  be  generated 


Pass  gathered  data  and  information  through  various 
systems  designed  to  turn  raw  data  into  intelligence 


Use  intelligence  and  data  to  assess,  characterize  and 
anticipate  and  defeat  terrorist  threats 


Ensure  the  timely  transmission  and  availability  of 
information  pertaining  to  threats  and  current  and 
potential  activities  of  terrorists 


Function:  Direct  Intelligence  Activities:  Conduct  strategic  planning  and  direct  intelligence 
activities. 

Task 

Definition 

Identify  information 
needs. 

Define,  coordinate,  and  prioritize  standing  (long-term)  and  short-term 
information  requirements. 

Evaluate  capability 
shortfalls. 

Determine  the  adequacy  of  current  capabilities. 

Identify  information 
gaps. 

Assess  intelligence  against  requirements. 

Apply  resources. 

Refine  and  allocate  capabilities  across  the  U.S.  homeland  security 
community  (includes  intelligence  agencies  and  law  enforcement 
agencies). 
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Function:  Manage  Data  Collection:  Gather  raw  data  from  which  information  and  intelligence 
will  be  generated. 

Task 

Definition 

Determine  collection 
requirements. 

Translate  prioritized  information  requirements  into  specific  collection 
options  to  include  identification  of  collection  shortfalls  and/or  gaps. 

Allocate  collection 

resources. 

Allocate  resources  to  prioritized  requirements. 

Collect  new  data. 

Collect  data  on  threats. 

Verify  satisfaction  of 
collection  requirement. 

Review  data  for  shortfalls  and/or  gaps,  and  identify  additional 
collection  requirements. 

Function:  Process  Data  Into  Intelligence:  Pass  gathered  data  and  information  through  various 
systems  designed  to  turn  raw  data  into  intelligence. 

Task 

Definition 

Process  data. 

Conduct  technical  and  nontechnical  processing  and  exploitation  of 
data. 

Develop  information  for 
analysis. 

Convert  collected  data  into  products  that  can  be  readily  used. 

Function:  Analyze  Intelligence:  Gather  raw  data  from  which  information  and  intelligence  will  be 
generated. 

Task 

Definition 

Review  collected  data 
and  information. 

Determine  if  information  has  intelligence  value. 

Assess  validity  of 
information  and  sources. 

Appraise  information  and  the  sources  from  which  it  comes  for 
credibility,  reliability,  pertinence,  and  accuracy. 

Integrate  information. 

Identify  and  group  together  related  items  of  information  to  improve 
the  reliability,  credibility,  and  completeness  of  the  information. 

Analyze  information. 

Apply  appropriate  techniques  to  information  to  derive  meaningful 
intelligence. 

Coordinate  intelligence 
analyses. 

Validate  and  evaluate  analyses  with  interagency,  state,  tribal, 
regional,  and  local  partners. 

Determine  intelligence 
gaps. 

Evaluate  intelligence,  and  recommend  any  necessary  improvements 
to  ensure  consumers’  intelligence  requirements  are  satisfied. 

Generate  intelligence 
products. 

Produce  finished  and  unfinished  intelligence  at  appropriate 
classification  level  and  format. 
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Function:  Disseminate  Threat  Information:  Ensure  the  timely  transmission  and  availability 
of  information  pertaining  to  threats  and  current  and  potential  activities  of  terrorists. 

Task 

Definition 

Determine  intelligence 
end-user  product 
requirements. 

Identify  user  and  user  requirements  for  finished  intelligence 
products  to  include  transmission  mechanism,  classification, 
format,  and  timeliness. 

Disseminate  intelligence. 

Provide  timely  intelligence  products  in  the  appropriate  format 
and  classification  to  identified  users. 

Provide  indications  and 
warning. 

Report  time-sensitive  intelligence  on  terrorist  activities  that  could 
threaten  the  United  States. 
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Objective:  Control  Access 


Conduct  security  functions  to  prevent  entry  of  terrorists 
and  the  instruments  of  terrorism  to  the  United  States  and/or 
access  to  targets  and  natural  resources  of  the  United  States 


Pre-screen  and  analyze  people  and  materials  en  route  to  or 

within  the  United  States  to  identify  high  risk  individuals  and  materials 


Inspect  or  examine  people  and  materials  to  identify  individuals, 
substances,  devices,  or  other  items  that  pose  a  danger 


Monitor  borders,  territorial  seas,  points  of  entry  into  the  United  States 
and  adjacent  areas,  and  potential  terrorist  targets,  especially  critical 
infrastructure  nodes  and  conveyances 


Function:  Pre-Screen  People  and  Materials:  Pre-screen  and  analyze  people  and  materials  en 
route  to  or  within  the  United  States  to  identify  high-risk  individuals  and  materials. 

Tasks 

Definitions 

Develop  lookout  lists. 

Create  listings  of  people/materials  with  attributes  potentially  related  to 
terrorist  activities. 

Identify  people/material 
requiring  further 
inspection. 

Analyze  information  pertaining  to  travel  and  trade  with  the  United 
States  to  identify  people/material  requiring  further  inspection — to 
include  coordination  with  foreign  governments  (e.g.,  analyze 
passenger  manifests,  bills  of  lading,  etc.) — for  suspicious  activity. 

Conduct  background 
checks. 

Screen  applicants/employees/others  who  will  have  access  to 
conveyances,  key  assets,  and/or  information  (clear  employees  for 
access  to  and  handling  of  sensitive  information  before  permitting 
access  to  sensitive  areas. 

Notify  proper  authorities 
of  suspicious  activity. 

Relay  information  to  appropriate  U.S.  authorities  (e.g.,  notify  federal 
authorities  of  suspicious  individuals/trade  shipments  destined  to  arrive 
and/or  transit  in  the  United  States). 
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Function:  Screen/Inspect  and  Restrict  People  and  Materials:  Inspect  or  examine  people  and 
materials  to  identify  individuals,  substances,  devices,  or  other  items  that  pose  a  danger. 

Task 

Definition 

Grant  access  to 
conveyances/facilities. 

Authorize  interaction  with  or  entry  into  restricted  conveyances, 
facilities,  and  regulated  cargo  (e.g.,  HAZMAT). 

Screen/Inspect 

individuals  and 
materials. 

Inspect  and  validate  documentation  (e.g.,  verify  not-on-lookout  lists). 

Maintain  post-inspection 
integrity  of  individuals 
and  materials. 

Ensure  people  and  materials  are  secure  and  not  permitted  to  be 
contaminated  after  prescreening/inspection. 

Restrict  movement  of 
suspicious  people/ 
material  when  required. 

Restrict  the  movement  of  those  people/materials  suspected  of  being 
related  to  terrorism. 

Notify  proper  authorities 
when  required. 

Notify  officials  when  inspection  yields  individuals/materials 
potentially  related  to  terrorist  activities. 

Function:  Monitor  Areas:  Monitor  borders,  territorial  seas,  points  of  entiy  into  the  United  States 
and  adjacent  areas,  and  potential  terrorist  targets,  especially  critical  infrastructure  nodes  and 
conveyances. 

Task 

Definition 

Manage  monitoring 
activities. 

Direct,  determine,  prioritize,  and  integrate  monitoring  activities. 

Monitor  key  assets. 

Maintain  visibility  of  vehicles,  people,  and  material  coming  to  and 
departing  from  key  assets. 

Monitor  border. 

Maintain  visibility  of  vehicles,  people,  and  material  coming  to  and 
departing  from  the  United  States. 

Track  movement. 

Detect  movement  and  transfer  of  terrorists  and/or  material. 

Report  observations. 

Provide  operational  information  to  identified  users  in  a  timely 
manner. 

Deploy  detection 
systems. 

Provide  surveillance  and  information  systems  to  facilitate  early 
detection  and  mitigation. 
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Objective:  Eliminate  Threats 


Eradicate  terrorist  threats  using  all  the  tools  in  our 
Nation’s  arsenal  to  stop  those  who  wish  to  do  us  harm 


Track  and  probe  suspected  terrorists  and  activities 


Seize  and  detain  suspected  terrorists 


Intercept  and  seize  information,  substances,  components, 
technologies,  and  weapons  potentially  used  for  terrorist  activities 


Neutralize,  by  dislocating,  disabling,  and/or  destroying, 
terrorist  weapons 


Apply  the  full  range  of  legal  measures  and  processes  against 
suspected  terrorists  and  their  supporters 


Function:  Investigate  Terrorism  Suspects:  Track  and  probe  terrorists,  suspected  terrorists  and 
terrorist  activities. 

Task 

Definition 

Gather  actionable 
intelligence. 

Review  actionable  intelligence  regarding  terrorist  suspect  activities. 

Conduct  surveillance  of 
suspects. 

Monitor  terrorist  suspects  to  gather  evidence  based  on  actionable 
intelligence. 

Interview  victims  and 
witnesses. 

Gather  information  and/or  evidence  from  witnesses  regarding  threats 
and/or  incidents. 

Seek  appropriate  court 
authorities. 

Seek  issuance  of  appropriate  court  authority  to  facilitate  investigative 
efforts. 

Employ  appropriate 
investigative  methods. 

Use  appropriate  investigative  techniques  including  forensic 
examination,  polygraph,  financial,  and  communications 
investigations,  etc. 

Preserve  evidence. 

Process  and  document  evidence  to  include  maintaining  a  chain  of 
custody  that  can  be  used  in  the  apprehension  and  eventual  prosecution 
of  a  suspect. 

Conduct  public  affairs 
operations. 

Implement  public  outreach  and/or  awareness  programs,  public  service 
announcements,  and  public  diplomacy. 
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Function:  Apprehend  Suspects:  Seize  and  detain  suspected  terrorists  under  proper  authority. 

Task 

Definition 

Identify  suspects. 

Positively  recognize  suspected  terrorists  . 

Locate  suspects. 

Identify  the  location  of  suspected  terrorists. 

Survey  suspects. 

Monitor  the  suspect’s  movements,  activities,  and  associates. 

Interview  suspects. 

Gather  information  from  interviews  pertaining  to  unlawful  acts, 
terrorism,  or  other  potentially  harmful  activities. 

Apprehend  suspects. 

Detain  and/or  arrest  suspects  and  process  them  in  the  judicial  system 
under  proper  authority. 

Transport  suspects. 

Move  suspect  from  arrest  location  to  secure  facility. 

Dismantle  terrorist 
training. 

Eliminate  terrorist  training  capabilities,  both  physical  and  cyber, 
including  the  sources  of  support. 

Conduct  public  affairs 
operations. 

Implement  public  outreach  and/or  awareness  programs,  public  service 
announcements,  and  public  diplomacy. 

Function:  Seize  Materials:  Intercept  and  seize  information,  substances,  components, 
technologies,  and  weapons  potentially  used  for  terrorist  activities  under  proper  authority. 

Task 

Definition 

Identify  suspect 
conveyances. 

Identify  conveyances  employed  in  terrorist  activities. 

Intercept/board 

conveyance. 

Enter  conveyance  of  potential  terrorist  material  to  include  sea  vessels, 
airplanes,  trains,  trucks,  automobiles,  and  cyber  systems. 

Identify  materials. 

Positively  identify  materials  and  associated  hazards. 

Divert  conveyance. 

Direct  the  delivery  of  a  terrorist  material  away  from  its  destination. 

Track  conveyance  and/or 
materials. 

Locate  and  track  conveyances  and/or  materials  employed  in  terrorist 
activities,  and  maintain  contact. 

Search  for  materials. 

Search  suspect  sites  for  potential  terrorist  material,  including 
information,  substances,  components,  technologies,  and  weapons, 
under  appropriate  authority. 

Inspect  materials. 

Examine,  verify,  and  seek  materials,  including  information, 
substances,  components,  technologies,  and  weapons  potentially  used 
for  terrorist  activities. 

Render  materials  safe. 

Neutralize  threat  agents,  materials,  computer  code,  precursors,  and 
residual  products  to  make  them  safe. 

Maintain  custody  of 
materials. 

Secure  and  document  materials  under  positive  control  of  appropriate 
authorities  including  the  establishment  of  chain  of  custody. 

S tore  materials  safely. 

Label  and  place  materials  in  appropriate  secure  storage. 

Transport  materials 
safely. 

Implement  standard  packaging  and  transport  procedures  for  known  or 
suspected  terrorist  material. 

Dispose  of  suspected/ 
known  material. 

Destroy,  retain,  or  transfer  materials  under  appropriate  authority. 

Conduct  public  affairs 
operations. 

Implement  public  outreach  and/or  awareness  programs,  public  service 
announcements,  and  public  diplomacy. 
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Function:  Defeat  Weapons:  Neutralize,  by  dislocating,  disabling,  and/or  destroying,  terrorist 
weapons. 

Task 

Definition 

Identify  weapon. 

Positively  identify  weapon  and  associated  hazards  including  possible 
secondary  devices. 

Conduct  threat  modeling 
and  simulation. 

Provide  threat  predictive  analyses  to  support  weapons  defeat 
operations  and  consequence  mitigation. 

Track  weapon/  delivery 
system. 

Identify  and  track  the  path  of  the  terrorist  weapon  and  its  delivery 
system. 

Neutralize  weapon- 
delivery  system. 

Render  the  weapon’s  delivery  system  safe,  ineffective,  unusable,  or 
harmless. 

Secure  weapon. 

Isolate  and  control  the  weapon,  including  establishing  a  safety 
perimeter. 

Transport  weapon 
safely. 

Implement  standard  safe  packaging  and  transporting  procedures  for 
known  or  suspected  weapons. 

Divert  weapon/delivery 
system. 

Redirect  the  delivery  of  a  terrorist-controlled  weapon  away  from  its 
intended  target  in  order  to  mitigate  potential  consequences. 

Safeguard  public 
welfare. 

Act  to  safeguard  the  community  good,  e.g.,  evacuation,  shelter  in 
place. 

Render  weapon  safe. 

Neutralize  threat  agents,  materials,  computer  code,  precursors,  and 
residual  products  to  make  them  safe,  ineffective,  unusable,  or 
harmless. 

Dispose  of  suspected/ 
known  material. 

Destroy,  retain,  or  transfer  materials  under  appropriate  authority. 

Conduct  public-affairs 
operations. 

Implement  public  outreach  and/or  awareness  programs,  public  service 
announcements,  and  public  diplomacy. 
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Function:  Prosecute  Suspected  Terrorists:  Apply  the  full  range  of  legal  measures  and  processes 
against  suspected  terrorists  and  their  supporters. 

Task 

Definition 

Detain  suspects. 

Confine  suspects  in  a  secure  facility  under  appropriate  authority. 

Review  the  formal 
investigation. 

Assess  legal  sufficiency  and  completeness  of  the  investigation  through 
investigative  reports  to  ensure  requisite  elements  of  probable  cause  have 
been  met. 

Initiate  criminal  charges. 

Convene  grand  jury  or  follow  appropriate  charging  process  to  formally 
charge  suspects. 

Conduct  pretrial 
hearings. 

Hold  required  pretrial  arraignment  hearings,  including  bail  and  bond 
hearings,  in  front  of  appropriate  judicial  body. 

Conduct  extradition 
hearing  where 
appropriate. 

Institute  extradition  proceedings,  when  necessary,  in  order  to  transfer 
suspects  from  one  jurisdiction  to  another. 

Conduct  deportation 
proceedings  where 
appropriate. 

Institute  deportation  proceedings  when  necessary  in  order  to  remove 
suspects  from  U.S.  territory  to  their  country  of  citizenship  or  other 
destination  as  appropriate. 

Adjudicate  case. 

Perform  all  tasks  necessary  to  bring  case  before  proper  tribunal  (e.g., 
research,  draft  pleadings,  conduct  plea  bargain  discussions,  litigate 
case). 

Impose  the  sentence  for 
convicted  terrorists. 

Impose  sentence  in  accordance  with  the  court’s  disposition/rulings. 

Provide  for  appeals 
process. 

Perform  all  tasks  necessary  to  handle  appeal  of  case. 

Conduct  public  affairs 
operations. 

Implement  public  outreach  and/or  awareness  programs,  public  service 
announcements,  and  public  diplomacy. 

Initiate  asset  forfeiture. 

Auction,  retain,  or  transfer  to  the  government  the  terrorist  financial 
assets  and  other  property. 
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Mission:  Protect 

Reduce  the  likelihood  of  attack  on  assets/resources  or  systems,  and  limit  the  impact 
should  an  attack  occur. 

Objective:  Assess  Critical  Infrastructure  and  Key  Assets 

In  the  material  presented  below,  the  terms  Critical  Infrastructure/Key  Assets  (CI/KA)  and 
Critical  Infrastructure/Key  Resources  (CI/KR)  are  used  interchangeably.  The  MAA  Study 
team  uses  both  terms  to  present  the  findings  generated  by  the  interagency  workshop 
participants  as  they  were  recorded  during  the  actual  workshop  events. 


Identify  and  assess  systems  and  assets,  whether  physical  or  virtual, 
so  vital  that  the  incapacity  or  destruction  of  such  systems  and  assets 
would  have  a  debilitating  impact  on  security,  national  economic 
security,  and/or  national  public  health  or  safety 


Employ  best  practices  for  data  management  to  collect  and  sort 
information  on  candidate  CI/KR  according  to  appropriate  criteria 


Determine  first  order  consequences  in  terms  of  loss  of  life, 
economic  impact,  psychological  impact,  and  critical  mission  execution 


Assess  threats,  vulnerabilities,  and  consequences  using  a  variety  of 
tools  and  measures  in  order  to  closely  approximate  the  degree  of 
risk  associated  with  each  candidate  instance  of  CI/KR 

Assess  threats,  vulnerabilities,  and  consequences  using  a  variety  of 
tools  and  measures  in  order  to  closely  approximate  the  degree  of  risk 
associated  w/key  interdependencies  and  cascading  effects  across  CI/KR 

Employ  best  practices  for  data  management  to  develop  and  apply 
prioritization  criteria  to  CI/KR  within  and  across  all  homeland  security  sectors 
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Function:  Catalogue  Assets  and  Systems:  Employ  best  practices  for  data  management  to  collect  and 
sort  information  on  candidate  CI/KR  according  to  appropriate  criteria. 

Task 

Definition 

Establish  criteria  for  data 
collection. 

Define  the  specific  information  that  needs  to  be  collected  within  a  sector. 

Collect  data. 

Access  infrastructure  and  resource  information  (e.g.,  facilities,  systems, 
key  personnel),  including  information  from  CI/KR  owners  and  operators. 

Verify  data. 

Ensure  that  information  collected  is  reliable  and  accurate. 

Store  data. 

Secure  information  according  to  established  standards  and  protocols. 

Generate  reports. 

Prepare  outputs  of  data,  analysis,  and  synthesis  consistent  with  end  user 
requirements. 

Share  information. 

Provide  data/reports  to  end  users  based  on  their  needs  and  in  accord  with 
established  standards,  protocols,  and  security  requirements. 

Maintain  data. 

Assess  routinely  the  relevance,  accuracy,  completeness,  quality,  and 
timeliness  of  data,  and  modify  as  required. 

Function:  Identify  Gross  Consequences  to  Assets  and  Systems:  Determine  first  order 
consequences  in  terms  of  loss  of  life,  economic  impact,  psychological  impact,  and  critical  mission 
execution. 

Task 

Definition 

Assess  potential 
consequences. 

Identify  results  of  CI/KR  being  destroyed,  disrupted,  exploited,  or 
otherwise  compromised. 

Verify  data. 

Ensure  that  information  collected  is  reliable  and  accurate. 

Generate  reports. 

Prepare  outputs  of  data,  analysis,  and  synthesis  consistent  with  end-user 
requirements. 

Assess  potential 
consequences. 

Identify  results  of  CI/KR  being  destroyed,  disrupted,  exploited,  or 
otherwise  compromised. 

Verify  data. 

Ensure  that  information  collected  is  reliable  and  accurate. 

Generate  reports. 

Prepare  outputs  of  data,  analysis,  and  synthesis  consistent  with  end-user 
requirements. 
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Function:  Estimate  Risk  to  CI/KR:  Assess  threats,  vulnerabilities,  and  consequences  using  a  variety 
of  tools  and  measures  to  closely  approximate  the  degree  of  risk  associated  with  each  candidate  instance 
of  CI/KR. 

Task 

Definition 

Assess  potential 
consequences. 

Identify  results  of  CI/KR  being  destroyed,  disrupted,  exploited,  or 
otherwise  compromised. 

Analyze  vulnerabilities  in 
light  of  threats. 

Determine  how  vulnerabilities  are  affected  by  threats  and  actions  available 
to  reduce  these  vulnerabilities. 

Develop  tools  and 
methods  for  vulnerability 
assessments. 

Create  and  continuously  enhance  the  means  to  accurately  identify  and 
assess  vulnerabilities. 

Determine  probability  of 
success. 

Calculate  the  chance  of  an  attack  coming  to  fruition  against  an  asset. 

Function:  Evaluate  Interdependencies,  Cascading  Effects,  and  Risks  to  Systems:  Assess  threats, 
vulnerabilities,  and  consequences  using  a  variety  of  tools  and  measures  to  closely  approximate  the 
degree  of  risk  associated  with  key  interdependencies  and  cascading  effects  across  CI/KR. 

Task 

Definition 

Develop  risk 
assessment  tools  and 
methods. 

Design  and  develop  standard  tools  and  methods  to  assess  risk  due  to 
interdependencies. 

Map  relationships. 

Detail  sector  roles  and  responsibilities  for  interacting  with  other  federal 
agencies,  state  and  local  governments,  and  the  private  sector. 

Analyze 

interdependencies 
within  sectors. 

Delineate  risks  affecting  critical  assets  in  a  sector  and  their  probable  effects  on 
other  assets  within  the  same  sector. 

Analyze 

interdependencies 
across  sectors. 

Delineate  risks  affecting  critical  assets  in  one  sector  and  their  probable  effect  on 
other  sectors. 

Normalize  data. 

Ensure  that  all  data  are  consistent  in  scope,  scale,  and  methodology  to  enable 
comparison  within  and  across  sectors. 

Verify  data. 

Ensure  that  information  collected  is  reliable  and  accurate. 

Store  data. 

Secure  information  according  to  established  standards  and  protocols. 

Generate  reports. 

Prepare  outputs  of  data,  analysis,  and  synthesis  consistent  with  end-user 
requirements. 

Share  information. 

Provide  data/reports  to  end  users  based  on  their  needs  and  in  accord  with 
established  standards,  protocols,  and  security  requirements. 

Maintain  data. 

Assess  routinely  the  relevance,  accuracy,  completeness,  quality,  and  timeliness 
of  data,  and  modify  as  required. 
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Function:  Prioritize  CI/KR:  Employ  best  practices  for  data  management  to  develop,  and  apply 
prioritization  criteria  to  CI/KR  within  and  across  all  homeland  security  sectors. 

Task 

Definition 

Develop  cross  sector 
prioritization  criteria. 

Rank  relative  importance  of  CI/KR  across  sectors  using  a  variety  of 
methodologies. 

Apply  criteria  against 
CI/KR  risks  across 
all  sectors. 

Sort  CI/KR  risks  in  all  sectors  against  prioritization  criteria  to  create  a 
comprehensive  rank-ordered  list. 

Normalize  data. 

Ensure  all  data  are  consistent  in  scope,  scale,  and  methodology  to  enable 
comparison  within  and  across  sectors. 

Verify  data. 

Ensure  that  information  collected  is  reliable  and  accurate. 

Store  data. 

Secure  information  according  to  established  standards  and  protocols. 

Generate  reports. 

Prepare  outputs  of  data,  analysis,  and  synthesis  consistent  with  end-user 
requirements. 

Share  information. 

Provide  data/reports  to  end  users  based  on  their  needs  and  in  accord  with 
established  standards,  protocols,  and  security  requirements. 

Maintain  data. 

Assess  routinely  the  relevance,  accuracy,  completeness,  quality,  and 
timeliness  of  data  and  modify  as  required. 
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Objective:  Implement  Protective  Programs  for  Assets  and 
Systems 


Protect  critical  infrastructures  and  key  assets  to  deter  and  mitigate 
terrorist  attacks 


Determine  the  most  cost-effective  and  balanced  set  of  countermeasures 
to  reduce  strategic,  tactical,  and  operational  risk 


Protect  assets  by  mitigating  or  delaying  the  actual  attack 


Reduce  the  attractiveness  of  a  target  by  lessening  potential  consequences 


Function:  Manage  Risk:  Determine  the  most  cost-effective  and  balanced  set  of  countermeasures 
to  reduce  strategic,  tactical,  and  operational  risk. 

Task 

Definition 

Gather  information. 

Incorporate  range  of  information  available,  including  prioritized  risk 
assessment  data,  relevant  guidelines,  regulations,  security  directives, 
best  practices,  private  sector  data,  Sector  Coordinating  Councils, 
Government  Coordinating  Councils,  etc. 

Identify  risk  reduction 
options. 

Identify  protective  and  devaluation  measures  based  on  risk 
assessments  that  can  be  applied  to  specific  classes  of  assets  or 
systems  both  within  and  across  sectors. 

Estimate  the  reduction  in 
risk  based  on  threat, 
vulnerability,  and 
consequence  (loss 
reduction  analysis). 

Use  a  systems-analysis  approach,  taking  into  account  unintended 
consequences;  include  the  four  dimensions  of  consequences: 
numbers  of  lives  lost,  economic  damage,  psychological  impact,  and 
impact  on  mission  execution. 

Estimate  the  cost  of 
execution  (cost-benefit 
analysis). 

Use  a  systems-analysis  approach;  include  interdependencies  and 
range  of  costs  (e.g.,  social  costs,  privacy,  safety,  etc.). 

Generate  optimum  risk 
reduction  strategy. 

Balance  cost  and  risk  reduction  (for  particular  risks  as  well  as 
portfolio  of  risk  reduction  options);  apply  resource  allocation 
methodologies  to  produce  balanced  strategy  that  can  reduce  risks  to  a 
prioritized  list  of  critical  assets  or  systems  across  sectors. 

Implement  risk  reduction 
strategy. 

Implement  the  chosen  strategy  while  remaining  cognizant  of 
regulations,  standards,  guidelines,  security  directives,  etc. 

Monitor  compliance  with 
risk  reduction  strategies. 

Ensure  compliance  within  the  regulatory  environment. 

Communicate  risk. 

Inform  owners,  operators,  key  personnel  of  potential  threats,  vulnera¬ 
bilities,  ways  to  protect  themselves  against  these  risks  using  a  variety 
of  media,  educational  outlets;  include  a  feedback  loop  in  the  process. 
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Function:  Defend  CI/KR:  Protect  assets  by  mitigating  or  delaying  the  actual  attack. 

Task 

Definition 

Protect  key  personnel. 

Ensure  the  safety  of  critical  personnel;  methods  may  include  exposure 
protection,  inoculation,  PPE,  prophylaxis,  etc. 

Harden  assets  and 
systems. 

Design  and/or  implement  layered  array  of  permanent  and  persistent 
security  measures  (e.g.,  structural  integrity,  physical  barriers,  CCTV, 
sensors)  designed  to  limit  the  vulnerability  of  critical  infrastructure 
and  key  resources  to  the  spectrum  of  relevant  threats. 

Restrict  access. 

Establish  reliable  and  persistent  mechanisms  (e.g.,  buffer  zones, 
checkpoints,  guards)  for  limiting  entiy  and  exit  to  CI/KR  to  only 
authorized  persons,  conveyances,  materials,  and  information. 

Deploy  assets  to  defend. 

Execute  the  plan  designed  to  defend  CI/KR;  assets  employed  may 
include  humans,  dogs,  equipment,  weapon  systems,  etc. 

Function:  Devalue  Potential  Targets:  Reduce  the  attractiveness  of  a  target  by  lessening  potential 
consequences. 

Task 

Definition 

Disperse  critical 
components. 

Include  both  the  physical  and  cyber  realm  (e.g.,  expand  the  distance 
between  the  physical  locations  of  assets  to  minimize  the  overall 
potential  damage)  in  the  dispersal. 

Develop  redundancies. 

Enhance  robustness  of  critical  infrastructure,  key  assets,  and  key 
personnel,  particularly  in  essential  function  systems  (utilities,  cyber, 
communications,  etc.),  by  integrating  duplicative  capabilities  that 
provide  back-up  functionality  when  primary  assets  are  degraded  or 
destroyed. 

Remove  high 
consequence  aspects  of 
high  value  targets. 

Change  the  characteristic(s)  of  a  target  in  some  way  (e.g.,  using  less 
hazardous  materials,  planning,  and  pre-event  positioning)  to  limit  the 
magnitude/duration  of  consequences  and  facilitate  rapid  recovery. 

Relocate  key  resources 

Withdraw  or  remove  key  resources  (assets,  systems,  and/or  key 
personnel)  from  high  risk  areas. 
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Objective:  Mitigate  Risk  to  Public 


Implement  measures  to  protect  the  public  and  mitigate 
the  potential  consequences  of  threats 


Implement  protective  measures  to  limit  the  vulnerability 

of  the  public  and/or  animals  potentially  at  risk  to  specific  threats 


Provide  protection,  security  planning  and  technical  assistance, 
technology  support,  and  public  safety  in  pre-incident  situations 


Inform  the  public  about  potential  threats  and  vulnerabilities  and 
ways  to  protect  themselves  against  these  risks  using  a  variety  of  media 
and  educational  outlets 


Function:  Safeguard  Public  Health:  Implement  protective  measures  to  limit  the  vulnerability  of 
the  public  and/or  animals  potentially  at  risk  to  specific  threats. 

Task 

Definition 

Conduct  appropriate 
public  health 
surveillance  and 
testing  processes. 

Monitor  the  health  of  the  general  population  and  special  high  risk 
populations,  carry  out  field  studies  and  investigations,  monitor  injury  and 
disease  patterns  and  potential  disease  outbreaks;  not  limited  to 
monitoring  people,  also  included  is  the  surveillance  of  livestock, 
agriculture,  water,  and  air;  link  regional,  national,  and  international 
medical  surveillance  networks  to  track  the  spread  of  disease  outbreaks. 

Assure  provision  of 
available  preventative 
medicines  and 
vaccines. 

Maintain  a  stockpile  preparedness  program  at  all  levels  (Federal,  tribal, 
state,  and  local). 

Maintain  notification 
and  information 
exchange  systems. 

Maintain  a  secure  reporting  and  notification  system  that  provides  rapid 
and  accurate  receipt  of  reports  of  disease  outbreaks  and  other  acute 
health  events. 

Provide  preventive 
medical  treatment. 

Provide  prophylaxis  to  those  at  risk. 

Develop  laboratory 
plans,  procedures,  and 
protocols. 

Develop  laboratory  plans,  procedures,  and  protocols  to  provide  rapid  and 
effective  laboratory  services. 
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Function:  Provide  Public  Safety:  Provide  protection,  security  planning  and  technical  assistance, 
technology  support,  and  public  safety  in  pre-incident  situations. 

Task 

Definition 

Conduct  public  safety 
and  security  assessment. 

Analyze  potential  factors  that  affect  resources  and  actions  needed  for 
public  safety  and  security. 

Provide  site  security. 

Provide  security  forces  and  establish  protective  measures  around  the 
potential  incident  site  or  hazard. 

Provide  traffic  and 
crowd  control. 

Address  public  safety  by  directing  the  public  away  from  potentially 
hazardous  situations  in  an  orderly  and  efficient  manner. 

Force  protection. 

Provide  for  the  protection  of  emergency  responders  and  other  workers 
operating  in  a  high-threat  environment. 

Function:  Educate  and  Prepare  the  Public:  Inform  the  public  about  potential  threats  and 
vulnerabilities  and  ways  to  protect  themselves  against  these  risks  using  a  variety  of  media  and 
educational  outlets. 

Task 

Definition 

Develop  strategic 
communications  plan. 

Develop  pre-tested,  easily  understood  messages  addressing  the 
public’s  concerns  about  threats,  and  identify  credible  community 
spokespersons. 

Distribute  public 
information  materials 
identifying  hazards  and 
threats. 

Employ  the  full  range  of  communications  media  (print,  broadcast, 
Internet,  etc.)  as  required  to  ensure  that  the  public  has  broad  access  to 
relevant  safety  and  security  information,  especially  key  steps  for 
recognizing  and  responding  to  likely  hazards  and  threats. 

Provide  public  safety  and 
security  education 
programs. 

Design  and  implement  courses  of  instruction  regularly  available  to  the 
public  at  regional,  state,  tribal,  and  local  levels  that  provide 
information  regarding  best  practices  for  public  safety  and  security 
related  to  events  of  mass  effect. 

Develop  public  protective 
action  guidelines. 

Research,  articulate,  refine,  and  distribute  best  practices  for  public 
safety  and  security  related  to  events  of  mass  effect. 

Prepare  volunteers  for 
incident  support. 

Maintain  and  expand  national  programs  preparing  volunteers  to 
recognize  and  respond  to  relevant  hazardous  materials  and  threats. 
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Mission:  Respond 

Implement  immediate  actions  to  save  lives,  protect  property,  and  meet  basic  human 
needs. 


Objective:  Assess  Incident 


Determine  the  nature  of  the  incident,  investigate  the  cause  of  the 
incident,  assess  the  situation,  identify  critical  and  unmet  needs, 
provide  recommendations  for  protective  actions,  and  identify  and 
coordinate  acquisition  and  delivery  of  required  assets  and/or  resources 


Probe  all  possible  sources  and/or  causes  of  an  incident 


Recognize,  identify,  analyze,  confirm,  and  evaluate  the  immediate 
consequences  of  an  incident 


Conduct  internal  communications  and  disseminate  information  during 
an  emergency  to  provide  situational  information  to  all  necessary  organizations 


Function:  Investigate  Incident:  Probe  all  possible  sources  and/or  causes  of  an  incident. 

Task 

Definition 

Obtain  assets  needed 
for  investigative 
operations. 

Procure  necessary  personnel,  equipment,  technology,  etc.,  to  conduct 
investigative  activities. 

Conduct  investigations. 

Determine  the  causal  particulars  of  the  incident,  e.g.,  the  “who,  what, 
where.” 

Obtain  technical 
assistance  and 
laboratory  support. 

Obtain  more  in-depth  analysis  of  information  collected  during 
investigation. 

Create  incident/crime 
scene  reports. 

Document  and  preserve  information  gathered  from  the  scene  of  the 
incident. 
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Function:  Assess  Hazards  and  Consequences:  Recognize,  identify,  analyze,  confirm,  and 
evaluate  the  immediate  consequences  of  an  incident. 

Task 

Definition 

Conduct  public  health/ 
casualty  assessment. 

Assess  and  determine  the  status  of  the  public’s  health  via 
epidemiologic  investigation(s). 

Assess  integrity  of 
physical  infrastructure. 

Conduct  building,  public  works,  and  engineering  assessments. 

Deploy 

surveillance/detection 

equipment. 

Use  equipment  and  techniques  to  monitor  the  incident  and  identify  the 
extent  and  nature  of  the  incident. 

Assess  weather 
conditions. 

Obtain  the  weather  forecast  and  assess  conditions  to  conduct  hazard 
zone  protection;  assess  how  the  weather  will  potentially  impact  an 
incident  site,  and  develop  mitigation  measures  accordingly. 

Classify  incident  scene 
areas. 

Determine/rate  the  extent  of  damage  of  various  sites  within  the 
effected  area,  i.e.,  hot,  warm,  and  cold  zones. 

Conduct  ongoing  risk/ 
damage  assessment. 

Periodically  reevaluate  and  update  the  assessment  of  incident  damages 
and  consequences. 

Function:  Conduct  Internal  Communications:  Conduct  internal  communications,  and 
disseminate  information  during  an  emergency  to  provide  situational  information  to  all  necessary 

organizations. 

Task 

Definition 

Establish  and  maintain 
response  communi¬ 
cations  network. 

Develop,  implement,  and  maintain  communications  capabilities  to 
assure  information  availability  and  sharing. 

Operate  incident  site 
communications. 

Facilitate  on-site  communication. 

Implement  interoperable 

Ensure  that  information  passed  is  transmitted  and  understood  by  all 

information  systems. 

users/systems. 

Provide  information 
system  security. 

Protect  the  systems  used  and  information  passed. 

Activate  back-up 
communication  and 
information  systems. 

Provide  for  information  sharing  and  redundant  communication 
capabilities  should  a  system  fail. 
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Objective:  Minimize  Impact 


Implement  and  coordinate  immediate  actions  to  contain  the  direct 
effects  of  an  incident 


Control  access  to  impacted  site(s)  and  manage  and  command  all 
activities  in  the  area(s) 

Reduce  or  eliminate  ongoing  risks  to  persons  or  lessen  the  actual  or 
potential  effects  or  consequences  of  an  incident,  including  removing 
contamination  to  acceptable  levels  from  individuals,  animals, 
equipment,  and  facilities 

Guard  the  public  from  potentially  hazardous  effects  of  an  incident, 
including  evacuation,  shelter-in-place,  and  isolation/quarantine 


Locate  and  extricate  victims 


Disseminate  situational  information  to  the  public 


Function:  Manage  Incident:  Control  access  to  impacted  site(s),  and  manage  and  command  all 

activities  in  the  area(s). 

Task 

Definition 

Activate  incident  command 

Establish  a  unified  command  system  involving  all 

system. 

stakeholders  to  coordinate/activate  response  functions. 

Manage  and  disseminate  public 

Inform  the  public  of  the  status  of  the  incident  and  protective 

information. 

actions  to  take. 

Control  access  to  the  impact 
site(s). 

Coordinate  and  provide  transportation/logistics  support, 
activate  approved  traffic  control  plan,  and  identify  and 
establish  incident  perimeter  zone. 

Provide  telecommunication  and 

Ensure  communication  among  incident  commanders  and 

information  technology  support. 

managers 

Manage  physical  resources 
impacted  by  an  incident. 

Provide  engineering  and  other  support  for  structures,  public 
works,  and  infrastructure  systems,  e.g.,  turn  on/off  utilities, 
identify  failing  buildings  and  structures,  etc. 

Establish  systems  for  describing, 
inventorying,  requesting,  and 
tracking  resources. 

Detail  the  status  of  all  resources  used  in  managing  the 
incident. 

Demobilize  response  resources. 

Reallocate/release  resources  that  were  acquired  but  are  no 
longer  needed. 
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Function:  Respond  to  Hazard:  Reduce  or  eliminate  ongoing  risks  to  persons  or  lessen  the 
actual  or  potential  effects  or  consequences  of  an  incident,  including  removing  contamination  to 
acceptable  levels  from  individuals,  animals,  equipment,  and  facilities. 

Task 

Definition 

Identify  affected  populations  and 

Determine  those  people,  animals,  and/or  infrastructure 

infrastructure. 

(equipment  and  facilities)  affected  by  an  incident. 

Separate  those  people,  animals,  and/or  pieces  of 

Isolate  affected  populations  and 

infrastructure  (equipment  and  facilities)  contaminated  in  an 

infrastructure. 

incident  from  their  surroundings  (this  task  also  includes 
measures  to  shelter-in-place)  to  the  extent  possible. 

Coordinate  and  conduct 
firefighting  support/operations. 

Extinguish  fires  and  mitigate  associated  threats. 

Coordinate  and  conduct  oil  and 
HAZMAT  response. 

Mitigate  the  potential  threats  associated  with  these  materials. 

Coordinate  and  conduct  explo¬ 
sive  devise  detection,  defusing, 
and  disposal  operations. 

Mitigate/eradicate  the  danger  posed  by  explosive  devises. 

Secure  contamination  sources 

Isolate  and  secure  (i.e.,  prevent  access  to)  sources  of 

and  effected  areas. 

contamination  and  the  areas  effected. 

Identify  assets  required  for 

Determine  those  assets/resources  most  applicable  given  the 

decontamination  activities. 

specifics  of  the  incident. 

Procure  assets  required  for 
decontamination  activities. 

Develop  contamination  site  safety  plan  and  acquire  those 
assets/resources  most  applicable  given  the  specifics  of  the 
incident. 

Decontaminate  affected 

Remove  contamination  to  acceptable  levels  from  individuals, 

populations  and  infrastructure. 

animals,  equipment,  and  facilities. 

Function:  Implement  Protective  Actions:  Guard  the  public  from  potentially  hazardous  effects 
of  an  incident,  including  evacuation,  shelter-in-place,  and  isolation/quarantine. 

Task 

Definition 

Coordinate  public  safety  and 
security  response. 

Integrate  the  capabilities  and  responsibilities  of  public  safety 
and  security  assets  in  the  response  effort. 

Identify  safety/security  asset 
requirements. 

Determine  what  capabilities  and  capacities  are  required  to 
ensure  scene/zonal  and  public  security. 

Acquire  required  safety/security 
assets/resources. 

Procure  those  assets/requirements  necessary  to  protect  the 
public. 

Provide  public  safety  and 
security  support. 

Ensure  safety/security,  e.g.,  evacuation,  shelter-in-place, 
isolation,  quarantine,  etc. 

Activate  approved  traffic  control 
plan. 

Reroute/design  traffic  flow  patterns  to  allow  egress  for  those 
affected  by  an  incident  as  well  as  to  minimize  public 
exposure  to  potential  hazards. 
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Function:  Conduct  Search  and  Rescue:  Locate  and  extricate  victims. 

Task 

Definition 

Determine  search  and  rescue 
course  of  action. 

Determine  search  and  rescue  requirements  given  the 
location,  nature  of  the  incident,  etc. 

Coordinate  search  and  rescue 
efforts. 

Integrate  the  capabilities  and  responsibilities  of  all  assets  in 
the  search  and  rescue  effort;  coordinate  the  search  and  rescue 
response. 

Deploy  search  and  rescue  teams. 

Deploy  teams  based  on  assessment  of  the  incident. 

Conduct  urban  search  and  rescue 
operations. 

Conduct  urban  search  and  rescue  operations  as  required  . 

Conduct  water  search  and  rescue 
operation. 

Conduct  water  search  and  rescue  operations  as  required. 

Redeploy  to  home  base. 

Reevaluate  strategy,  reassess  operating  environment,  etc. 
with  returned  search  and  rescue  teams. 

Function:  Distribute  Public  Information:  Disseminate  situational  information  to  the  public. 

Task 

Definition 

Prepare  emergency  public 
information  plans. 

Determine  information  to  be  delivered  to  the  public,  i.e., 
determine  what  is  to  be  delivered,  who  is  to  deliver  it, 
through  what  medium,  etc. 

Coordinate  emergency  public 

Direct  and  control  public  information  releases,  e.g.,  through 

information. 

the  joint  information  system  (JIS). 

Designate  individual(s)/ 
organization(s)  to  address  the 
public. 

Provide  unified  face  to  the  public  to  ensure  uniformity  of 
message. 

Activate  warning  systems,  and  provide  critical  information 

Provide  emergency  health  and 
medical  information. 

and  warnings  in  order  to  convey  information  to  both  the 
media  and  the  public  prepared  in  multiple  languages  and 
using  a  range  of  media  (e.g.,  printed  materials,  handouts, 

TV,  radio,  Internet,  text  messaging,  etc.) 
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Objective:  Care  for  Public 


Implement  immediate  actions  to  save  lives  and  meet  basic  human 
needs  to  minimize  the  impact  of  an  incident  and  prevent  further  harm 


Provide  immediate  medical  support  to  individuals  and/or  animals 
affected  by  an  incident 


Provide  preventative  medical  measures  to  affected  and/or  potentially 
affected  individuals 

Meet  basic  needs  of  individuals  and/or  animals  affected  by  an  incident, 
including  sheltering  of  persons,  organizing  feeding  operations,  collecting 
and  providing  information  on  victims  to  family  members,  and  coordinating 
bulk  distribution  of  emergency  relief  items 

Identify,  decontaminate,  and  dispose  of  remains 


Function:  Provide  Medical  Care:  Provide  immediate  medical  support  to  individuals  and/or 
animals  affected  by  an  incident. 

Task 

Definition 

Coordinate,  the  medical 
response. 

Establish/activate  an  emergency  command  and  triage  system. 

Mobilize  emergency 
health  care  specialists  and 
health  care  providers. 

Direct  needed  general  and  specialized  health  care  personnel  to 
locations  where  they  are  most  needed. 

Conduct  triage. 

Identify  range  of  injuries  suffered  by  victims,  ranging  from 
casualties  to  minor  injuries;  triage,  treat,  and  transport  as  appropriate. 

Provide  immediate 
emergency  aid. 

Provide  life-saving  assistance  to  those  in  need,  e.g.,  first  aid, 
bandaging,  blood  products,  crisis  intervention,  etc. 

Track  patient  status  and 
location. 

Identify  and  track  by  condition  and  location  those  affected  by  an 
incident;  monitor  for  trends. 

Function:  Distribute  Prophylaxis:  Provide  preventative  medical  measures  to  affected  and/or 
potentially  affected  individuals. 

Task 

Definition 

Implement  prophylaxis 
protocols. 

Determine  population  segment  requirements  regarding  prophylaxis, 
i.e.,  who  needs  what  based  on  the  incident  and  identified 
hazard/threat;  implement  appropriate  monitoring  and  reporting 
mechanisms  for  follow-up  and  recording. 

Provide  prophylaxis. 

Administer  prophylaxis  to  necessary  population  segments. 

Assure  provision  of 
prophylaxis. 

Ensure  availability  of  preventative  medications  or  treatments  for  the 
identified  hazard  or  threat. 
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Function:  Provide  Mass  Care:  Meet  basic  needs  of  individuals  and/or  animals  affected  by  an  incic 
including  sheltering  people,  organizing  feeding  operations,  collecting  and  providing  information  on 
victims  to  family  members,  and  coordinating  bulk  distribution  of  emergency  relief  items 

Task 

Definition 

Activate  emergency 
shelters. 

Execute  and  implement  plans  to  determine  requirements  and  get 
necessary  shelters  established  and  operating. 

Provide  food  and  mass 
care  support. 

Coordinate  and  supply  food  and  mass  care  requirements. 

Provide  temporary 
housing. 

Coordinate  and  supply  housing  to  those  requiring  it. 

Establish  reception/ 
victim  assistance  centers. 

Coordinate  and  activate  personnel/locations  to  assist  those  affected 
by  the  incident. 

Arrange  for  animal  shelter 
services. 

Coordinate  and  activate  resources  for  sheltering  animals. 

Provide  food  and  mass 
care  support. 

Coordinate  and  supply  food  and  mass  care  requirements. 

Provide  temporary 
housing. 

Coordinate  and  supply  housing  to  those  requiring  it. 

Establish  reception/victim 
assistance  centers. 

Coordinate  and  activate  personnel/locations  to  assist  those  affected 
by  the  incident. 

Arrange  for  animal  shelter 
services. 

Coordinate  and  activate  resources  for  sheltering  animals. 

Function:  Manage  Fatalities:  Identify,  decontaminate,  and  dispose  of  remains. 

Task 

Definition 

Collect  human  and  animal 
remains. 

Collect  remains;  preserve  evidence  and  chains  of  custody. 

Isolate  human  and  animal 
remains. 

Segregate  corpses  and  related  material 

Identify  and  tag  human 
remains. 

Establish  identity  of  deceased  humans. 

Prepare  for  disposal  of 
diseased  human  and 
animal  remains. 

Remove  safely  and  prepare  remains  for  disposal  or  transfer. 

Perform  autopsies  and 
other  investigative/ 
scientific  inquiries. 

Determine  cause  of  death  and  perform  other  related  forensic  and 
scientific  investigations  (e.g.,  amount  of  exposure  to  a  harmful 
contaminant,  effect  of  contaminants  on  the  body,  etc.). 

Release  remains  to 
mortuary  services. 

Transfer  the  custody  of  noncontaminated  remains  to  mortuary 
services. 
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Mission:  Recover 

Develop,  coordinate,  and  execute  service-  and  site-restoration  plans  and  reconstitute 
government  operations  and  services  through  individual,  private-sector,  nongovernmental, 
and  public  assistance  programs. 


Objective:  Assist  Public 


Help  individuals  impacted  by  an  incident  to  return  to  pre-incident  levels, 
where  feasible 


Provide  for  the  long  term  mental  and  psychological  healthcare  of  affected 
individuals 


Inform  the  public  as  to  how  to  go  about  receiving  aid  throughout  the 
recovery  process 


Supply  individuals  with  social  service  assistance 


Function:  Provide  Long-Term  Healthcare:  Provide  for  the  long-term  mental  and  psychological 
healthcare  of  affected  individuals. 

Task 

Definition 

Provide  long-term  medical 
care. 

Render  necessary  long-term  health  care  to  victims  and  first 
responders. 

Provide  behavioral, 
substance  abuse,  counseling, 
and  mental  health  services. 

Supply  crisis  counseling,  family  support  services,  behavioral  and 
mental  health  services  to  public  and  first  responders. 

Restore  critical  medical 
services. 

Reorder  and  restore  health  and  medical  supplies  and  materials; 
restore  all  stockpiles  to  pre-incident  levels. 

Provide  medical  claims 
assistance. 

Offer  services  to  public  to  facilitate  and/or  expedite  the  medical 
claims  process. 

Monitor  persons  for  adverse 
treatment  reactions. 

Observe  and  monitor  persons  who  have  received  medical  care  to 
maintain  awareness  of  adverse  reactions  to  medical  treatments  or 
prophylaxis. 

Establish  a  health/disease 
registry  of  victims  and/or 
responders  at  risk. 

Develop  and  maintain  a  database  identifying  persons  (public  and 
first  responders)  at  risk  for  complications  for  injuries  or  treatment 
received. 

Conduct  ongoing  vector 
control. 

Monitor,  protect,  and/or  prevent  entry  to  an  identified  carrier  from 
one  possible  host  to  another. 

Conduct  long-term  health 
care  monitoring. 

Conduct  health  care  observations  of  affected  persons  and/or  first 
responders. 

Conduct  long-term  health 
care  assessment. 

Analyze  results  of  health  care  monitoring. 
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Function:  Provide  Long-Term  Healthcare:  Provide  for  the  long-term  mental  and  psychological 
healthcare  of  affected  individuals. 

Task 

Definition 

Provide  comprehensive 
stress  management 
strategies,  programs,  and 
crisis  response  teams. 

Offer  a  variety  of  stress  management  programs  for  exposed 
persons. 

Function:  Provide  Recovery  Information:  Inform  the  public  on  how  to  go  about  receiving  aid 
throughout  the  recovery  process. 

Task 

Definition 

Inform  public  about  services 
offered. 

Provide  culturally  sensitive  information  and/or  educational 
materials  to  the  public  about  all  of  the  services  that  may  be 
available  to  them  (health  education,  financial,  legal,  medical, 
counseling,  etc). 

Inform  public  about 
recovery  efforts. 

Make  information  and/or  educational  materials  available  to  the 
public  about  ongoing  recovery  efforts. 

Collect,  process,  and 
disseminate  disaster  welfare 
and  family  reunification 
information. 

Make  information  and/or  educational  materials  available  to  the 
public  about  long-term  effects  of  an  incident,  ongoing 
evacuations,  and  any  other  necessary  information. 

Function:  Provide  Social  Services:  Supply  individuals  with  social  service  assistance. 

Task 

Definition 

Conduct  response-related 
activities  for  nutritional 
assistance. 

Identify  and  arrange  ordering,  transportation,  storage,  and 
dispersal  of  food  and  food  related  products. 

Identify  long-term  housing 
needs. 

Coordinate  efforts  among  assistance  groups  to  identify  those 
individuals  who  need  long-term  housing  assistance. 

Establish  public  assistance 
centers. 

Set  up  centers  to  support  public’s  needs  including  those  of  special- 
needs  communities,  non-English  speaking  persons,  and  those  with 
medical  conditions  requiring  special  attention. 

Provide  volunteer  services. 

Establish  plans  to  utilize  volunteers  and  coordinate  with  NGOs 
and  other  volunteer  organizations;  activate  plans  for  identification, 
credentialing,  and  placement  of  unaffiliated,  spontaneous 
volunteers. 

Conduct  donations 
management. 

Perform  all  necessary  measures  including  monitoring  and 
reviewing  procedures  for  receipt,  inventories,  deployment,  and 
disposal  of  donations. 

Provide  community 
services. 

Offer  legal  and  financial  counseling. 

Provide  expedited 
processing  of  benefits 
claims. 

Provide  expedited  processing  of  benefits  and  claims  resulting  from 
an  incident. 
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Objective:  Restore  Environment 


(B)  Restore 
Environment 


(1)  Conduct 
Site  Cleanup 


(2)  Dispose 
of  Materials 


(3)  Conduct 
Site 

Remediation 


(4)  Restore 
Natural 
Resources 


Reestablish  or  bring  back  to  a  state  of  environmental  or  ecological 
health  the  water,  air,  and  land  and  the  equilibrium,  which  exists 
among  and  between  water,  air,  and  land  and  all  living  things 


Take  short-term!  immediate  actions  to  address  and  remove  releases 
of  hazardous  substances  that  require  expedited  response 


Remove  and/or  eliminate  animal  remains  and/or  agricultural  materials, 
as  well  as  other  materials,  equipment,  and  facilities  affected  by  an  incident 

Investigate  and  cleanup  any  known  or  suspected  discharge  or  threatened 
discharge  of  contaminants,  including,  preliminary  assessment,  site 
investigations,  remedial  investigations,  remedial  alternative  analyses,  and 
remedial  actions 

Return  ecosystem  to  a  close  approximation  of  its  condition  prior  to  disturbance 


Function:  Conduct  Site  Cleanup:  Take  short-term  immediate  actions  to  address  and  remove 
releases  of  hazardous  substances  that  require  expedited  response. 

Task 

Definition 

Provide  for 

isolation/quarantine  for 
natural  resource  and 
agricultural  threats. 

Prevent  the  movement  of  contaminated  or  potentially 
contaminated  agricultural  products  or  natural  resources  from  the 
secure  zone. 

Conduct  environmental 

Conduct  site  cleanup;  institute  mass  biosecurity/decontamination 

decontamination. 

measures. 

Conduct  product  tracing  to 
determine  source, 
destination,  disposition  of 
adulterated/  contaminated 
products. 

Monitor  movements,  and  ensure  security  of 
adulterated/contaminated  products. 
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Function:  Dispose  of  Materials:  Remove  and/or  eliminate  animal  remains  and/or  agricultural 
materials,  as  well  as  materials,  equipment,  and  facilities  affected  by  an  incident. 

Task 

Definition 

Collect  and  isolate  animal 
remains. 

Decontaminate,  identify,  and  dispose  of  animal  remains. 

Develop  protocols  for 
disposing  of  materials. 

Determine  rules,  roles,  and  responsibilities  for  the  disposal  of 
materials. 

Provide  clean-up  material 
and  equipment. 

Procure  and/or  assure  distribution  of  required  resources. 

Dispose  of  contaminated 
agricultural  products  to 
include  animals. 

Safely  remove  and  discard  or  destroy  material,  as  appropriate. 

Dispose  of  contaminated 
food. 

Safely  remove  and  discard/destroy  contaminated  foods. 

Dispose  of  diseased  human 
remains. 

Remove  safely,  dispose  of,  destroy,  or  release  human  remains  to 
mortuary  services,  as  appropriate. 

Dispose  of  oil,  HAZMAT, 
and  other  debris. 

Remove  safely  and  discard  materials. 

Function:  Conduct  Site  Remediation:  Investigate  and  cleanup  any  known  or  suspected  discharge 
or  threatened  discharge  of  contaminants  including  preliminary  assessment,  site  investigations, 
remedial  investigations,  remedial  alternative  analyses,  and  remedial  actions. 

Task 

Definition 

Conduct  long-term 
environmental  impact 
assessments. 

Inspect,  monitor,  and  assess  need  for  remediation  actions  in 
affected  areas. 

Conduct  long-term 
assessments  of  affected  or 
potentially  affected  animals 
(including  livestock  and 
wildlife). 

Monitor  animals  in  affected  areas  to  determine  if  or  to  what  extent 
contamination  or  disease  have  occurred. 

Determine  wildlife  exposure 

Monitor  wildlife  to  determine  if  they  were  exposed  to  hazardous 

and  disposition. 

substances,  and  make  decisions  about  their  disposition. 

Conduct  disease  risk 
assessment  and  surveillance. 

Conduct  disease  surveillance  and  epidemiological  studies. 

Determine  if  food  and/or  food  supply  is  contaminated  and  dispose 

Support  food  recovery. 

of  contaminated  products  (embargo  food,  inspect,  clean,  and/or 
monitor  food  facilities). 

38 


Homeland  Security  Strategic  Planning:  Mission  Area  Analysis 


Function:  Restore  Natural  Resources:  Return  ecosystem  to  approximation  of  its  condition  prior 
to  disturbance. 

Task 

Definition 

Restore  air  quality. 

Re-establish  the  air  quality  harmed  by  an  event  or  its  aftermath. 

Restore  water  quality. 

Re-establish  quality  of  water  harmed  by  an  event  or  its  aftermath. 
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Objective:  Restore  Infrastructure 


(C)  Restore 
Infrastructure 


(1) 

Reconstitute 

Government 

Services 


(2)  Rebuild 
Property 


(3)  Restore 
Lifelines 


(4)  Restore 
Economic 
Institutions 


Restore  infrastructure  in  affected  communities  in  order  to 
return  to  pre-incident  levels,  where  feasible 


Reinstate  government  services  and  operations  interrupted 
by,  or  in  response  to,  an  incident 


Rebuild  physical  structures  so  individuals,  businesses,  and 
governments  can  function  on  their  own,  return  to  normal  life, 
and  protect  against  future  hazards 

Ensure  the  restoration  of  any  and  all  utility  services  interrupted 
by,  or  in  response  to,  an  incident 


Restore  institutions  needed  to  sustain  economic  growth  and 
re-establish  public  confidence 


Function:  Reconstitute  Government  Services:  Reinstate  government  services  and  operations 
interrupted  by,  or  in  response  to,  an  incident. 

Task 

Definition 

Coordinate  and  conduct  the 
recovery  operation. 

Develop  re-entry  plans,  coordinate  infrastructure  assessments, 
and  prioritize  recovery  sequence. 

Develop  community  economic 
recovery  plans,  programs,  and 
procedures. 

Develop  mitigation,  recovery,  and  economic  stabilization 
programs,  plans,  and  procedures  designed  to  restore 
community  to  pre-incident  levels,  and  coordinate  community 
recovery  and  mitigation  actions. 

Establish  long-term  recovery 
goals. 

Assess  needs  and  capabilities  of  community/area  in  order  to 
create  achievable  recovery  goals. 

Function:  Rebuild  Property:  Rebuild  physical  structures  so  individuals,  businesses,  and 
governments  can  function  on  their  own,  return  to  normal  life,  and  protect  against  future  hazards. 

Task 

Definition 

Develop  plans,  protocols,  and 
procedures  for  buildings,  public 
works,  and  engineering  services 
and  departments. 

Identify  critical  infrastructure  and  interdependencies;  manage 
mutual  aid  agreements. 

Conduct  building  repairs. 

Provide  public  works,  building  regulation,  and  engineering 
support  during  recovery. 

Conduct  inspections  and 
assessments. 

Carry  out  inspections  and  safety  assessments  of  public  and 
private  buildings  in  affected  areas. 

Implement  recovery  and 
restoration  activities. 

Manage,  schedule,  and  coordinate  restoration  of  critical 
infrastructure  service,  facilities,  and  assets. 
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Function:  Restore  Lifelines:  Ensure  the  restoration  of  any  and  all  utility  services  interrupted  by, 
or  in  response  to,  an  incident. 

Task 

Definition 

Assess  damage  to  energy  and 
utility  production  and 
distribution  infrastructure. 

Evaluate  effects  of  incident  on  utility  infrastructure. 

Coordinate  energy  related 
support. 

Identify  public  and  private  resources  able  to  provide  immediate 
restoration  of  key  facilities  and  utilities.. 

Conduct  energy  recovery  and 
restoration  operations. 

Work  to  restore  utilities  damaged  during  an  event. 

Assess  incident  impact  on 
production,  distribution,  and 
use  of  energy. 

Survey  energy  producers  and  distributors  to  determine  overall 
supply  production  and  distribution  capacity;  assess  impact  of 
energy  loss  on  impacted  area  (persons,  residences,  businesses, 
etc.). 

Function:  Restore  Economic  Institutions:  Restore  institutions  needed  to  sustain  economic 
growth  and  re-establish  public  confidence. 

Task 

Definition 

Provide  economic  stabilization, 
community  recovery,  mitigation 
support,  and  financial 
restitution  to  financial 
systems/institutions. 

Assess  economic  consequences  as  the  local,  state,  and  federal 
levels. 

Provide  community  services. 

Have  trained  personnel  available  for  the  provision  of  financial, 
unemployment  and  financial  counseling  (loans,  grants,  etc.)  to 

affected  persons. 
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4.0  Recommendations 

The  HSI  study  team  recommends  that: 

•  The  task  sponsor  encourage  DHS  senior  leadership  to  prioritize  the  elements  of 
the  HS  MAA.  The  Analytic  Hierarchy  Process  (AHP)  or  the  Analytic  Network 
Process  (ANP)  could  be  used  for  that  purpose. 

•  HSI  help  determine  the  interrelationships  and  interdependencies  of  HS  MAA 
Tasks  through  the  development  of  HS  architecture. 

•  HSI  develop  performance  measures  for  all  levels  of  the  HS  MAA  elements.  Such 
an  effort  should  be  coordinated  with  related  DHS  efforts  such  as  the  national 
preparedness  planning  being  conducted  to  implement  HSPD-8. 

•  DHS  planners  use  the  HS  MAA  framework  and  performance  measures  to  1) 
identify  gaps  in  homeland  security  capability  and  2)  guide  the  development  of 
solutions. 

•  DHS’s  institutional  missions  be  functionally  decomposed.  Institutional  mission 
space  is  not  addressed  in  great  detail  either  by  the  MAA  Taxonomy  resulting 
from  the  interagency  task  development  workshop  process  or  in  the  proposed 
revised  version  (the  All-Hazards  Taxonomy)  developed  by  G&T  and  interagency 
stakeholders.  Decomposing  DHS’s  institutional  missions  would  provide  value  to 
the  Department’s  senior  leadership  as  a  powerful  analytic  tool  in  establishing 
priorities  and  budget  tradeoffs  essential  to  a  resource-constrained  environment. 
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5.0  Addendum 

The  version  of  the  HSI  five-level  MAA  Hierarchy  resulting  from  the  workshop  process 
provided  DHS  and  its  interagency  stakeholders  (including  federal,  state,  local,  tribal,  and 
private  sector)  with  a  unifying  framework  for  identifying  and  coordinating  an  integrated 
approach  for  HS  mission  activities.  This  MAA  Taxonomy  has  been  used  by  the  DHS 
Science  and  Technology  Directorate  (S&T)  and  the  DHS  Chief  Financial  Officer 
Planning  and  Estimating  Office  (CFO  PA&E)  to  assist  in  identifying  potential  gaps  in 
homeland  security  programs. 

The  concept  of  homeland  security  has  continued  to  evolve  as  the  taxonomy  has  been  used 
and  as  world  events  have  continued  to  unfold.  The  initial  draft  of  this  report  was  prepared 
based  on  the  analysis  of  the  national-level  strategy  developed  after  the  terrorist  events  of 
9/11.  Consequently,  the  concept  of  homeland  security  that  underpinned  this  report’s 
initial  presentation  of  the  homeland  security  mission  space  centered  on  terrorism  and  did 
not  include  activities  required  to: 

•  Protect  American  lives  and  property  from  major  natural  disasters  and  accidents. 

•  Respond  to  and  recover  from  the  consequences  of  those  events. 

Since  completing  the  initial  draft  of  this  report,  the  homeland  security  mission  area 
analysis  has  been  refined  through  collaboration  involving  the  HSI  and  DHS’s 
Preparedness  and  Science  and  Technology  Directorates.  This  process  has  employed  a 
revised  concept  of  homeland  security  — all  hazards  in  scope,  integrating  activities 
previously  subsumed  under  national  preparedness.  The  results  of  the  subsequent  mission 
area  analysis,  now  known  as  the  All-Hazards  Taxonomy,  are  contained  in  this  addendum. 

The  Evolving  Taxonomy 

Three  key  events  provided  the  impetus  for  continued  refinement  of  the  MAA  Taxonomy: 

•  The  lessons  learned  from  the  use  of  the  taxonomy  by  S&T  and  CFO  PA&E 

•  The  excess  of  natural  disasters  in  2005 

•  The  attempt  by  the  DHS  Office  of  Grants  and  Training  (G&T)  to  use  the  MAA  to 
evaluate  the  Universal  Task  List  (UTL)  and  the  UTL’s  associated  Target 
Capabilities  List  (TCL) 

Each  key  event  showed  that  further  work  was  needed  on  the  MAA  to  broaden  its  scope 
while  simultaneously  refining  and  sharpening  the  focus  of  each  of  its  elements. 

The  use  of  the  MAA  Taxonomy  by  S&T  and  CFO  PA&E  highlighted  inconsistencies  in 
how  functions  and  capabilities  were  defined,  particularly  in  the  Prevent  and  Protect 
mission  areas.  The  natural  disasters  of  2005  dramatically  highlighted  the  need  to  look 
beyond  terrorism-related  events  and  establish  a  broader  decomposition  of  the  homeland 
security  mission,  focusing  on  all  hazards  rather  than  only  terrorism.  G&T’s  attempt  at 
mapping  the  UTL  and  TCL  to  the  MAA  Taxonomy  to  identify  potentially  missing  target 
capabilities  highlighted  two  critical  issues:  first,  all  target  capabilities  are  not  of  the  same 
size,  scale,  and  format;  and  second,  the  MAA  Taxonomy  includes  Functions  that  are 
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process  focused  and  those  that  are  operations  focused,  making  mapping  with  TCL  more 
difficult.4 

In  response  to  these  issues,  HSI,  G&T,  and  other  elements  supporting  G&T  began  an 
MAA  Taxonomy  refinement  process  in  parallel  with  work  to  enhance  and  expand  the 
TCL.  Refinement  consisted  of  reviewing,  clarifying,  and  making  the  objectives, 
functions,  and  tasks  more  precise,  incorporating  them  into  a  proposed  new  version  of  the 
Taxonomy  that  involves  an  all-hazards  focus  and  synchronizes  the  Taxonomy  with  the 
TCL. 

Synchronization  consisted  of  three  key  activities:  first,  the  original  taxonomy’s  process- 
focused  Objectives  and  Functions  were  removed  and  replaced  with  operations-focused 
Objectives  and  Functions  where  appropriate.  In  doing  this,  G&T,  HSI,  and  interagency 
stakeholders  developed  a  method  for  standardizing  changes  to  the  taxonomy.5  This 
method  includes  technical  definitions  for  key  taxonomy  terms  such  as  “Objective,” 
“Function,”  and  “Task,”  and  rules  for  making  further  modifications  to  the  MAA 
framework.6 7  Second,  after  the  MAA  Taxonomy  was  reviewed  and  expanded  to  reflect  an 
all-hazards  perspective,  the  target  capabilities  were  mapped  to  the  Taxonomy.  This 
mapping  highlighted  gaps  and  redundancies  in  the  existing  target  capabilities. 7  Third,  the 
Common  Tasks  of  the  post- workshop  version  of  the  MAA  Taxonomy  were  exchanged 
for  a  set  of  Capability  Elements  that  are  operationally  similar.  These  elements  are  listed 
within  each  capability  of  the  TCL  and  thus  generally  correspond  to  most  All-Hazards 
Taxonomy  functions. 

Rationales  for  proposed  changes  in  each  original  MAA  Taxonomy  Mission  Area  are 
consistent  with  creating  a  unifying  framework  that  supports  mappings  Target  Capabilities 
cleanly  to  operationally-oriented  MAA  Functions. 

In  the  Prevent  mission  area,  proposed  edits  arose  from  three  particular  needs.  First,  the 
Detect  Threats  Objective  functions  were  changed  from  process-oriented  functions  into 
operational-oriented  functions.  Second,  the  Control  Access  Objective  required  more 
narrowly  worded  functions  to  minimize  overlap  between  functions.  Third,  the  Eliminate 
Threats  Objective  required  some  language  changes  to  become  consistent  with  the 
modified  functions  under  the  Detect  Threats  Objective.  A  summary  of  changes  in  the 
Prevent  mission  area  is  provided  in  Figure  6  below. 


4  Process-focused  functions  refer  to  a  generic  practice  or  course  of  action  (not  necessarily 
homeland  security  related)  without  referring  to  desired  outcome.  Operations-focused  functions, 
by  contrast,  refer  to  a  specific  type  of  action  that  homeland  security  partners  perform  and  include 
some  indication  of  the  desired  outcome. 

5  Appendix  D  summarizes  the  rules  for  this  method. 

6  Appendix  C  provides  the  definitions  for  the  MAA/A11  Hazards  Taxonomy  levels. 

7  Appendix  E  provides  the  results  of  the  mapping. 
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Post-MAA  Workshops  Proposed  Version 

Version 


Figure  6.  Comparison  of  Original  and  Proposed  Prevent  Mission  Structures 


In  the  Protect  mission  area,  proposed  modifications  were  also  driven  by  three  specific 
requirements.  First,  Objectives  under  Protect  in  the  original  MAA  Taxonomy  were 
changed  from  process-oriented  into  operational-oriented  functions.  Second,  the  Protect 
mission  area  was  reconciled  with  the  National  Infrastructure  Protection  Plan  (NIPP) 
framework.  In  this  regard,  Functions  addressing  physical  assets  and  systems  were 
organized  together  as  were  Functions  addressing  living  beings,  whether  humans  or 
animal.  Particularly,  the  term  “public  health  protection”  was  used  to  cover 
medical/biological  dangers  and  the  term  “life  safety  protection”  was  used  to  cover 
physical  dangers.  Third,  language  used  in  the  Protect  mission  area  was  made  consistent 
with  the  responder  community’s  "protection"  terminology.  A  summary  of  proposed 
changes  to  the  Protect  mission  area  is  provided  in  Figure  7  below. 
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Post-MAA  Workshops 
Version 


Proposed  Version 


Figure  7.  Comparison  of  Original  and  Proposed  Protect  Structures 


Common  Tasks  vs.  Capability  Elements 

The  post-workshops  version  of  the  MAA  Taxonomy  and  the  TCL  both  contain  sets  of 
general  enablers.  In  the  MAA  Taxonomy,  these  are  the  Common  Tasks  that  apply  to  each 
MAA  Function  in  addition  to  its  Function  Specific  Tasks.  In  the  TCL,  the  Capability 
Elements  apply  to  each  of  he  Target  Capabilities  and  define  the  resources  needed  to 
perform  critical  tasks  to  specified  performance  levels.  In  addressing  the  role  of  the 
general  enabler  in  the  proposed  All-Hazards  Taxonomy,  the  participants  decided  it  was 
best  to  use  the  Capability  Elements  used  in  the  TCL  to  characterize  the  general  enablers 
of  the  All-Hazards  Taxonomy.  A  comparison  of  the  common  tasks  and  capability 
elements  is  provided  in  Figure  8  below. 


48 


Homeland  Security  Strategic  Planning:  Mission  Area  Analysis 


Figure  8.  Transition  from  Common  Tasks  to  Elements  of  Capability 

After  incoiporating  all  changes  developed  through  the  G&T-led  refinement,  the  MAA 
Taxonomy  now  appears  as  the  All-Hazards  Taxonomy  shown  in  Figure  9. 
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Note  1:  Common  Tasks  occur  across  all  Functions:  (A)  Planning  and  Coordination,  (B)  Preparedness,  (C)  Resource  Management, 
(D)  Communications  &  Information  Management,  (E)  Supporting  Technology, 

Note  2:  Function-Specific  Tasks  enable  the  function  to  be  performed. 

Figure  9.  Updated  All  Hazards  Taxonomy  (Effective  August  2006) 
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Appendix  A:  Task  Development 
Workshop  Report:  Coordination  Inputs 


A=accepted;  R=rejected;  M=modified 


MAA 

Element 


Source 


Decision  „  . 

Comment  Rationale 

A/R/M 


Prevent 

B1 


Change  into  two  Tasks:  “Pre- 
CUBIC  Screen  People”  and  “Pre-Screen 
Materials.” 


Prevent 

B2 


CUBIC 


Change  into  two  Tasks: 
“Screen/Inspect  and  Restrict 
People”  and  “Screen/Inspect 
and  Restrict  Materials.” 


Prevent 

C5 


4. 


Prevent 

B1 


Question:  Should  state  or 
federal  warrants  be  issued  to 
initiate  charges  for  prosecution? 
(Considering:  Virginia  law,  for 
one,  allows  capability  to  set  “no 
bond”  whereas  federal  law 
requires  “a  bond  be  set.”) 

Seems  like  it  would  be  easier, 

CUBIC  ^6SS  err°r  Prone’  etc'’ t0  init*ate 
state  charges  contempora¬ 
neously,  and  later  move  the 
cases  to  the  respective  federal 
courts.  However,  if  initiated  as 
federal  charges 
contemporaneously,  then 
training,  forms,  and  cross 
design-nation  would  be 
necessitated). 

Screen 

applicants/employees/others 
who  will  have  access  to  convey¬ 
ances  and  key  assets  and/or 

CUBIC  information  (e.g.,  clear 
employees  for  access  and 
handling  sensitive  information 
or  before  permitting  access  to 
sensitive  areas). 


Workshop  participants 
concluded  that  the 
functional  capabilities 
required  for  screening 
people  and  materials 
are  similar  and  should 
therefore  remain  one 
function. 

Workshop  participants 
concluded  that  the 
functional  capabilities 
required  for  screening 
people  and  materials 
are  similar  and  should 
therefore  remain  one 
function. 


The  organizational 
responsibility  is 
irrelevant  as  long  as 
the  functional 

R  capability  is  captured. 
(The  task  list  is 
concerned  with  the 
"whats"  and  not  the 
"whos.") 


The  change  broadens 
A  the  scope  and  adds 
clarity. 
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# 

MAA 

Element 

Source 

Comment 

Decision 

A/R/M 

Rationale 

5. 

Prevent 

B1 

CUBIC 

Relay  information  to 
appropriate  U.S.  authorities 
(e.g.,  notify  federal  authorities 
of  suspicious  individuals/trade 
shipments  destined  to  arrive 
and/or  transit  the  U.S.). 

A 

The  change  broadens 
the  scope  and  adds 
clarity. 

6. 

Prevent 

B2 

CUBIC 

Ensure  people  and  materials  are 
secure  and  not  permitted  to  be 
contaminated  after  pre¬ 
screening/inspection. 

A 

The  change  adds 
clarity. 

7. 

Prevent 

B2 

CUBIC 

Restrict  the  movement  of 
[Delete:  ...those...] 
people/materials  suspected  of 
being  [Delete:  . .  .related  to. . .] 
[Add:  . .  .involved  in. . .] 
terrorism. 

R 

The  workshop  agreed 
on  the  existing 
definition. 

8. 

Prevent 

B2 

CUBIC 

Notify  officials  when 
screening/inspections  yields 
individuals/materials  potentially 
[Delete:  ...related  to...]  [Add: 

. .  .involved  in. . .]  terrorist 
activities. 

R 

The  workshop  agreed 
on  the  existing 
definition. 

9. 

Prevent 

B3 

CUBIC 

Monitor  borders,  territorial  seas, 
points  of  entry  [Add:  .. ,  transit 
points. . .]  into  the  U.S.  and 
adjacent  areas,  and  potential 
terrorist  targets,  especially 
critical  infrastructure  nodes  and 
conveyances. 

R 

The  workshop  agreed 
on  the  existing 
definition. 

10. 

Prevent 

B3 

CUBIC 

Maintain  visibility  of  vehicles, 
people,  and  material  entering, 
departing,  and  transiting  the 

U.S. 

A 

The  change  broadens 
scope  and  adds  clarity. 

11. 

Prevent 

B3 

CUBIC 

Detect  movement  and  transfer 
of  terrorists  and/or  material. 

A 

The  change  broadens 
the  scope. 

12. 

Prevent 

B3 

CUBIC 

Provide  [Delete:  ...timely...] 
operational  information  to 
identified  users  [Add:  . .  .in  a 
timely  manner. . .]. 

A 

The  change  adds 
clarity. 

13. 

Prevent 

C 

CUBIC 

1st  Title  box  below:  Change 

Task  title:  “Eliminate  Threats” 
to  “Neutralize  Threats”  Change 
Task  definition:  “Eradicate  ....” 
to  “Neutralize.” 

R 

The  workshop  agreed 
on  the  task  title  and 
definition. 

14. 

Prevent 

Cl 

CUBIC 

Track  and  probe  [Add: 

...terrorist,  ...]  suspected 
terrorists  and  activities. 

A 

The  change  adds 
clarity. 
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# 

MAA 

Element 

Source 

Comment 

Decision 

A/R/M 

Rationale 

15. 

Prevent 

Cl 

CUBIC 

Monitor  terrorist  suspect  to 
gather  evidence  [Add:  ..., 
and/or  deter  acts  of 
terrorism. . .],  based  on 
actionable  intelligence. 

R 

The  concept  of 
deterrence  was 
discussed  at  the 
workshop  and  was 
identified  as  an 
outcome  of  all  tasks 
throughout  the 
hierarchy. 

16. 

Prevent 

Cl 

CUBIC 

Interview  victims  and  witnesses 
[invert  because  victims  usually 
interviewed  first,  witnesses 
second]  and 

Gather  information  and/or 
evidence  from  [Add:  ...victims 
and. . .]  witnesses  regarding 
threats  and/or  incidents. 

A 

Subject  matter  expert 
provided  input. 

17. 

Prevent 

Cl 

CUBIC 

Seek  appropriate  court  authority 
[change  from  authorities  to 
authority]. 

A 

The  change  adds 
clarity. 

18. 

Prevent 

Cl 

CUBIC 

Utilize  appropriate  investigative 
techniques,  including  forensic 
examination,  polygraph, 
financial  and  communications 
investigations,  etc. 

A 

The  change  adds 
clarity. 

19. 

Prevent 

Cl 

CUBIC 

Process  and  document  evidence, 
to  include  maintaining  a  chain 
of  custody  [Delete:  ...,  that  can 
be  utilized  in. . .]  [Add:  . .  .to 
sustain. . .]  the  apprehension  and 
[Delete:  ...eventual...] 
prosecution  of  [Delete:  . .  .a. . .] 
suspect. 

R 

The  workshop  agreed 
on  the  definition. 

20. 

Prevent 

C2 

CUBIC 

3rd  Title  box  below:  Change 

Task  definition  to  read:  “Seize 
and  detain  suspected  terrorist 
under  appropriate  authority.” 

A 

The  change  adds 
clarity. 

21. 

Prevent 

C2 

CUBIC 

Identify  suspected  terrorists 
[Delete:  “Positively”]. 

R 

Workshop  discussion 
stressed  the  need  for 
this  statement  to  be 
qualified  with 
“positively.” 

22. 

Prevent 

C2 

CUBIC 

Detain  and/or  arrest  suspects 
and  process  them  in  the  judicial 
system  under  appropriate 
authority. 

A 

The  change  adds 
clarity. 
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# 

MAA 

Element 

Source 

Comment 

Decision 

A/R/M 

Rationale 

23. 

Prevent 

C3 

CUBIC 

Intercept  and  seize  information, 
substances,  components, 
technologies,  and  weapons 
potentially  used  for  terrorist 
activities  under  appropriate 
authority. 

A 

The  change  adds 
clarity. 

24. 

Prevent 

C3 

CUBIC 

Direct  the  delivery  of  a  terrorist 
material  away  from  its  intended 
destination,  populated  areas 
and/or  critical  infrastructure. 

R 

The  addition  narrows 
the  scope  and 
generality  of  the  task, 
limiting  the 
applicability. 

25. 

Prevent 

C3 

CUBIC 

Locate  and  track  conveyances 
and/or  materials  used  in  terrorist 
activities.  Maintain  contact. 

A 

The  change  adds 
clarity. 

26. 

Prevent 

C3 

CUBIC 

Inspect,  examine,  and  seek 
mate-rials,  including 
information,  sub-stances, 
components,  technologies,  and 
weapons  potentially  [Delete: 

. .  .used  for. . .]  [Add:  . .  .useable 
in]  terrorist  activities. 

R 

This  change  broadens 
the  scope  of  the  task  to 
include  all  possible 
items  that  can  be  used 
for  terrorism,  not  only 
the  items  actually 
being  used  for 
terrorism  pur-poses 
that  concern  us. 

27. 

Prevent 

C3 

CUBIC 

Neutralize  threat  agents, 
materials,  computer  code, 
precursors  and  residual  products 
to  make  them  safe  [Delete: 

. .  .ineffective,  unusable  or 
harmless]. 

A 

The  change  adds 
clarity. 

28. 

Prevent 

C3 

CUBIC 

Change  task  definition  to 

Preserve  evidence,  secure  and 
document  materials  under 
positive  control  of  appropriate 
authorities  including  the 
establishment  of  a  chain  of 
custody. 

R 

The  workshop  agreed 
on  task  title  and 
definition. 

29. 

Prevent 

C3 

CUBIC 

Safely  secure  materials. 

R 

The  workshop  agreed 
on  task  title  and 
definition. 

30. 

Prevent 

C4 

CUBIC 

Positively  identify  weapon  and 
associated  hazards  including 
possible  secondary  devices. 

A 

The  change  adds 
clarity. 

31. 

Prevent 

C4 

CUBIC 

Identify  and  track  the  path  of 
the  terrorist  weapon  and  its 
delivery  system. 

A 

The  change  adds 
clarity. 

32. 

Prevent 

C4 

CUBIC 

Render  the  weapon’s  delivery 
system  safe,  ineffective, 
unusable,  or  harmless. 

A 

The  change  adds 
clarity. 
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# 

MAA 

Element 

Source 

Comment 

Decision 

A/R/M 

Rationale 

33. 

Prevent 

C4 

CUBIC 

Implement  standard  safe 
packaging  and  transporting 
procedures  for  known  or 
suspected  weapons. 

A 

The  change  adds 
clarity. 

34. 

Prevent 

C4 

CUBIC 

Neutralize  threat  agents, 
materials,  computer  code, 
precursors,  and  residual 
products  to  make  them  safe, 
ineffective,  unusable,  or 
harmless. 

A 

The  change  adds 
clarity. 

35. 

Prevent 

C5 

CUBIC 

Assess  legal  sufficiency  and 
completeness  of  the 
investigation  through 
investigative  reports  to  ensure 
requisite  elements  of  probable 
cause  have  been  met. 

A 

The  change  adds 
clarity. 

36. 

Prevent 

C5 

CUBIC 

[Delete:  Charge  suspects  with 
crime].  [Add:  Initiate  criminal 
charges]  Initiate  criminal 
charges,  convene  grand  jury  or 
follow  appropriate  charging 
process  to  formally  [Delete: 
indict]  [Add:  charge]  suspects. 

A 

The  subject  matter 
expert  provided  input. 

37. 

Prevent 

C5 

CUBIC 

Hold  required  arraignment, 
pretrial  hearings,  including  bail 
and  bond  hearings,  [Delete:  in 
front  of]  [Add:  before] 
appropriate  judicial  body. 

A 

The  subject  matter 
expert  provided  input. 

38. 

Prevent 

C5 

CUBIC 

When  necessary,  institute 
extradition  proceedings  in  order 
to  [Delete:  ...move...]  [Add: 
transfer]  suspects  from  one 
[Delete:  . .  .to  different 
jurisdictions]  [Add:  jurisdiction 
to  another  jurisdiction]. 

A 

The  subject  matter 
expert  provided  input. 

39. 

Prevent 

C5 

CUBIC 

[Delete:  Confine/supervise 
convicts]  [Add:  Impose 
sentence  in  accordance  with] 
[Delete:  . . .  according  to  the. . .] 
court’s  disposition/ruling. 

A 

The  subject  matter 
expert  provided  input. 
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MAA 

Element 


Source 


Decision  „  . 

Comment  Rationale 

A/R/M 


Suggest  using  caution  when 
using  terms  such  as  ROI  and 
cost-benefit  analysis.  CG 

40. 

Protect 

USOGHQ 

experience  is  that  measures  of 
returns  and  benefits  are  highly 

A 

The  change  broadens 

A5 

subjective  and  qualitative  at 
best.  “Subject  matter  expertise” 
and  “gut  feelings,”  if  you  will, 
don’t  lend  themselves  to 
concrete  rankings. 

the  scope. 

Protect 

B1 

This  is  the  second  occurrence  of 
the  use  of  measures  of 
effectiveness,  i.e.,  “cost 
effective.”  See  first  comment. 

National  guidance 
dictates  that  homeland 

41. 

USCGHQ 

R 

security  actions  must 
be  taken  in  a  cost- 
effective  manner. 

42. 

Protect 

B1 

USCGHQ 

If  the  suggestion  at  the  end  of 
the  “Observation”  paragraph  is 
taken,  you  will  have  the 
situation  where  a  task  matches 
the  function  “Identify  risk 
reduction  options.” 

A 

The  change  adds 
clarity  in  the 
hierarchy. 

Protect 

B1 

Another  occurrence  of  the  use 

National  guidance 
dictates  that  homeland 

43. 

USOGHQ 

of  measures  of  effectiveness. 

R 

security  actions  must 

See  first  comment. 

be  taken  in  a  cost 
effective  manner. 

44. 

Protect 

B2 

USOGHQ 

Task:  “Protect  key  personnel,” 
Change:  Precede  this  task  with  a 
task  that  identifies  essential  or 
key  personnel. 

R 

The  identification  of 
key  personnel  is 
included  in  the 
“Collect  data”  task 
under  Protect  Al. 

10  Key  Public  Health 

The  first  thing  the 

Components: 

team  did  was  ensure 

1 .  Monitor  Health  Status 

2.  Diagnose  and  Investigate 

3.  Inform,  Educated,  and 

Empower 

that  the  10  key  public 
health  components 
were  accounted  for  in 
our  MAA.  We  agreed 
that  the  first  two 

45. 

Protect, 

Respond, 

and 

Recover 

HHS 

4.  Mobilize  Community 
Partnerships 

5.  Develop  Policies  and  Plans 

6.  Enforce  Laws  and 

Regulations 

7.  Link  People  to  Services 

8.  Assure  a  Competent 

Workforce 

9.  Evaluate  Effectiveness, 

M 

(Monitor  Health  Status 
and  Diagnose  and 
Investigate)  were 
explicitly  housed  in 
the  MAA  (within  the 
Investigate  Incident 
and  Safeguard  Public 
Health  functions).  The 
remaining  8  fall  within 
"Common  Tasks" 

Accessibility,  and  Quality 

underlying  all 

10.  Research 

elements  of  the  tree. 
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MAA 

Element 


Source 


Decision  „  . 

Comment  Rationale 

A/R/M 


On  the  Safeguard  Public  Health 
slide,  add  the  task  "Develop  and 
test  crisis  and  emergency  risk 
communication  plans."  The 
definition  to  be  added  for  that 
task  is  "Crisis  and  emergency 
risk  communication  is  the  effort 
by  experts  to  provide 

46.  Protect  C  HHS  information  to  show  an 

individual,  a  family,  and/or  a 
community  how  to  make  the 
best  possible  decisions  about 
their  well-being  within  nearly 
impossible  time  constraints  and 
help  people  ultimately  to  accept 
the  imperfect  nature  of  choices 
during  the  crisis." 


The  team  felt  that  this 
idea  does,  in  fact,  need 
to  be  called  out 
specifically,  and  fits 
most  logically  at  the 
task  level  in  the 
"Mitigate  Risk  to 
Public"  branch,  within 
the  "Educate  and 
Prepare  the  Public" 
function  (see  next 
paragraph  for  an 
explanation  of  this  box 
title).  All  elements  of 
the  definition  for  this 
task  ("Crisis  and 
emergency 
management  risk 
communication  is  the 
effort...")  have  been 
incorporated  into  the 
definitions  of  the 
existing  tasks  within 
the  "Educate  and 
Prepare  the  Public" 
function. 


47. 


Protect 

C3 


HHS 


On  the  Mitigate  Risk  to  Public 
slide,  in  addition  to  Safeguard 
Public  Health  and  Provide 
Public  Safety,  add  "Educate  the 


The  "Educate  the 
Public"  piece  was 
raised  to  be  included 
in  the  function  title 
(hence  the  change  to 


Public"  and  "Develop  Pre- 

"Educate  and  Prepare 

Tested  Messages."  The  box 

the  Public").  Thanks 

connected  to  the  right  of 

for  calling  this  out  and 

"Educate  the  Public"  should 

stressing  the  education 

read,  "Provide  6th  grade-level 

piece  we  had  missed. 

scientific  education  on  threats  to 

Next,  we  incorporated 

increase  the  public's 

M 

the  "Develop  Pre¬ 

understanding  of  chemical, 

tested  Messages" 

biological,  radiological,  and 

suggestion  in  the 

nuclear  threats."  The  box  to  the 

following  way:  we 

right  of  "Develop  Pre-Tested 

created  a  new  task, 

Messages"  should  read  "Use 

within  the  "Educate 

scientific  methodology  to 

and  Prepare  the 

develop  easily  understood 

Public"  function 

messages  addressing  the 

entitled  "Develop 

public's  concerns  about  threats 

Strategic 

and  to  identify  credible 

Communications 

community  spokespersons." 

plan,"  with  the 
following  definition: 

"Develop  pre-Tested, 
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MAA 

Element 


Source 


Decision  „  . 

Comment  Rationale 

A/R/M 


Several  areas  required  a  Task 
that  includes  use  of  a  developed 
checklist.  A  checklist  ensures  all 
R  ,  possible  responders  and 

48.  ^  N( iB  resources  have  been  contacted. 

Specifically,  under  Respond  (A) 
Assess  Incident  (A3)  Conduct 
Internal  Communications,  add 
checklist  on  task  line  42. 


Additionally,  in  A3  I  don't 

Respond  ^  know  about  the  term  "Internal"; 

A3  however,  the  National  Guard  is 

both  local  and  national. 


Under  Respond  (B)  Minimize 
R  ,  Impact  (Bl)  Manage  Incident,  a 

50.  NGB  checklist  Task  should  be  added 

somewhere  between  lines  17— 

21. 


easily  understood 
messages  addressing 
the  public's  concerns 
about  threats,  and 
identify  credible 
community 
spokespersons." 


The  use  of  a  checklist 
can  generally  be 
thought  of  as  a 

R  solution  for  fulfilling 
one  or  more  of  the 
tasks.  It  is  not  a 
functional  capability. 


The  term  “Internal” 
includes 
communication 
between  proper 
authorities  at  all 

A  levels.  The  term  is  left 

generic  to  broaden  the 
scope  and  ensure 
applicability  across  all 
homeland  security 
missions. 

The  use  of  a  check-list 
can  generally  be 
thought  of  as  a 

R  solution  for  fulfilling 

one  or  more  of  the 
tasks.  It  is  not  a 
functional  capability. 


51. 


The  National  Guard  has  a  large 
concern  on  where  and  when  its 
participation  will  be  required. 
With  the  current  Operational 
tempo  of  NG  units  deploying  to 
combat  zones,  preparedness  on 
additional  mission  takings  is  a 
paramount  issue.  Future 
possible  DoD  Requests  For 
Assistance  should  be  discussed. 
DHS's  RFAs  to  DoD  will  most 
likely  be  tasked  to  the  Guard. 


We  added  a  comment 
N/A  regarding  the  role  of 
the  National  Guard. 


52 


The  future  threat  will  operate  We  added  a  comment 

NGB  across  an  integrated,  seamless,  N/A  regarding  the  role  of 

global  battlespace,  and  the  the  National  Guard. 
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MAA 

Element 


Source 


Decision  „  . 

Comment  Rationale 

A/R/M 


National  Guard  is  the  only  force 
that  can  operate  across  the 
entire  spectrum  of  that 
battlespace  by  leveraging  its 
unique  ability  to  operate  in  State 
Active  Duty,  Title  32,  and  Title 
10  statuses. 

Uncertainty  will  mark  the  future 
environment,  and  adaptability  is 

the  key  to  success  in  an  We  added  a  comment 

53.  NGB  uncertain  environment.  Ongoing  N/A  regarding  the  role  of 

National  Guard  efforts  and  new  the  National  Guard. 

initiatives  provide  that 

adaptability. 


59 


Homeland  Security  Strategic  Planning:  Mission  Area  Analysis 


This  page  blank 


60 


Homeland  Security  Strategic  Planning:  Mission  Area  Analysis 


Appendix  B:  MAA  Common  Task 
Definitions 

Common  Task 

Definition 

Source 

Build,  sustain,  and  improve  the  operational  capability  to 
prevent,  protect  against,  respond  to,  and  recover  from 
domestic  incidents.  Preparedness  includes: 

•  Planning,  training,  and  exercises 

National 

Preparedness 

•  Personnel  qualification  and  certification  standards 

Response 

•  Equipment  acquisition  and  certification  standards 

•  Publication  management  processes  and  activities 

Plan 

•  Mutual  aid  agreements  and  Emergency  Management 
Assistance  Compacts  (EMACs) 

Resource 

Management 

Coordinate  and  oversee  tools,  processes,  and  systems  that 
provide  incident  managers  with  timely  and  appropriate 
resources  during  an  incident.  Historically,  resource 
management  has  been  an  issue  at  incidents,  both  large  and 
small.  Resources  are  defined  as  personnel  and  major  items  of 
equipment  supplies,  and  facilities  available  for  assignments  to 
incident  operations  and  for  which  status  is  maintained. 

National 

Response 

Plan 

National 

Incident 

Management 

System 

Identify  the  requirements  for  a  standardized  framework  for 
communications,  information  management,  and  information¬ 
sharing  support  at  all  levels  of  incident  management. 

Communications 
and  Information 

•  Incident  management  organizations  must  ensure  that 
effective,  interoperable  communications  processes, 
procedures,  and  systems  exist  across  all  agencies  and 
jurisdictions. 

National 

Incident 

Management 

System 

Management 

•  Information  management  systems  help  ensure  that 
information  flows  efficiently  through  a  commonly 
accepted  architecture. 

•  Effective  information  management  enhances  incident 

management  and  response  by  helping  to  ensure  that 
decision  making  is  better  informed. 

Provide  supporting  technology  and  technological  systems 
essential  to  implement  incident  response  actions.  Examples 
include: 

•  Voice  and  data  communication  systems 

National 

Incident 

Management 

System 

Supporting 

Technology 

•  Information  management  systems  such  as  recordkeeping 

and  resource  tracking 

•  Data  display  systems 

Supporting  technologies  also  include  specialized  technologies 
that  facilitate  ongoing  operations  and  incident  management 
activities  in  situations  that  call  for  unique  technology-based 
capabilities. 
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Appendix  C:  MAA/All  Hazards  Taxonomy 
Level  Definitions 


Term 

Definition 

Foundation 

Mission 

The  principal  components  of  strategic  goals 

Derived  from  homeland 
security  strategic  goals 
established  by  the  Legislative 
and  Executive  branches  of 
government 

Objective 

A  series  of  related  operations  aimed  at 
accomplishing  a  strategic  mission  within  a  given 
time  and  space 

Derived  directly  from 
homeland  security  and 
interagency  strategic 
documents 

Function 

An  operation  performed  by  multiple  professional 
skill  sets  to  accomplish  a  common  objective 

Derived  from  Department- 
specific  documents 

Task 

A  discrete  action  that  enables  a  function  to  be 
accomplished  by  individuals  or  organizations 

Derived  from  standard 
operating  procedures 
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Appendix  D:  MAA/All  Hazards  Taxonomy 
Modification  Rules 


Changes  to  any  level  of  the  Taxonomy  (or  to  Capabilities)  should  follow  the  sequence  outlined 
below: 

1.  Definitional  change 

2.  Title  change 

3..  Deletion  or  addition  (of  capability,  function,  objective,  or  mission) 


Rules  for  Capabilities 

1. 

Definition:  A  capability  is  a  combination  of  resource  elements  required  to  achieve  a  desired 
outcome. 

2. 

A  capability  applies  to  only  one  function  and  therefore  applies  to  one  mission. 

3. 

A  capability  speaks  to  an  outcome,  not  a  process. 

4. 

Capabilities  have  an  operational  focus. 

5. 

Capabilities  are  composed  of  associated  common/supporting  tasks. 

6. 

Capabilities  are  essential  to  save  lives  and/or  avoid  substantial  property  losses. 

7. 

Capabilities  do  not  define  “basic  services,”  for  operational  response,  but  deal  with 
incremental  ability  to  address  large  scale  events. 

8. 

Several  capabilities  may  apply  to  the  same  function. 
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Appendix  E:  Mapping  MAA/All  Hazards 
Taxonomy  Functions  and  Target 
Capabilities 


Prevent 

MAA/All  Hazards  Taxonomy 
Function 

Phase  I  &  II  Target  Capabilities 

Identify  and  Track  Suspected 
Terrorists. 

Identification  and  tracking  of  suspected  terrorists 

Identify  and  Track  Terrorist 
Intentions. 

Identification  and  tracking  of  terrorist  motivations 

Identify  and  Track  Extremism 
and  Sources  of  Support. 

Recognition  and  tracking  of  extremism 

Determination  and  tracking  of  terrorist  support 

Identify  Terrorist  Capabilities. 

Determination  of  terrorist  ability  to  execute  threats 

Prescreen  People  and  Materials. 

Pre-entry  detection 

Screen/Inspect  and  Restrict 
People  and  Materials. 

Port  of  entry  inspection 

Infrastructure/facility  access  screening 

Transportation  screening 

Credentialing 

Monitor  Areas. 

Border  control 

Investigate  and  Apprehend 
Terrorist  Suspects. 

Law  enforcement  investigation  and  operations 

Seize  Materials. 

Interdiction/seizure  of  materials 

Interdiction/seizure  of  terrorist  assets  and  weapons 

Defeat  Weapons  and 

Capabilities. 

Defeat  of  weapons 

Disrupt  Sources  of  Support. 

Disruption  of  terrorist  sources  of  support 

Prosecute  Suspected  Terrorists. 

Prosecution  of  suspects 

Protect 

MAA/All  Hazards  Taxonomy 
Function 

Phase  I  &  II  Target  Capabilities 

Manage  Risk  to  Physical/Cyber 
Assets  and  Systems. 

Risk  management 

Defend  Physical  Assets  & 
Systems. 

Defense  and  devaluation  of  physical  assets  and  systems 

Denial  of  access  to  materials  that  may  be  weaponized 

Devalue  Cyber  Assets  & 

Systems. 

Defense  and  devaluation  of  cyber  assets  and  systems 

Manage  Risks  to  Human  and 
Animal  Health. 

Epidemiological  surveillance  and  investigation 

Food  and  agricultural  safety  and  defense 

Environmental  monitoring 
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Protect 

MAA/A11  Hazards  Taxonomy 
Function 

Phase  I  &  II  Target  Capabilities 

Natural  hazard  monitoring 

Public  health  laboratory  testing 

Protect  Human  and  Animal 
Health. 

Stockpile  management 

Mitigate  and  Protect  Life 

Safety. 

Mitigation  and  protection  of  life  safety 

Prepare  the  Public. 

Pre-incident  public  education 

Respond 

MAA/A11  Hazards  Taxonomy 
Function 

Phase  I  &  II  Target  Capabilities 

Assess  Incident. 

Scene  and  consequence  assessment 

Determine  Cause  and  Origin  of 
Incident. 

Incident  scene  investigation 

Onsite  incident  management 

Emergency  operations  center  management 

Manage  Incident. 

Critical  resources  logistics  and  distribution 

Responder  health  and  safety 

Emergency  public  information  and  warning 

Explosive  device  response  operations 

Respond  to  Hazard. 

F irefighting  operations/ support 

WMD/Hazardous  materials  response  and  decontamination 
Animal  health  emergency  support 

Implement  Protective  Actions. 

Isolation  and  quarantine 

Public  safety  and  security  response 

Citizen  protection:  evacuation  and/or  in-place  protection 
Environmental  health 

Conduct  Search  and  Rescue. 

Urban  search  and  rescue 

Water  search  and  rescue 

Triage  and  prehospital  treatment 

Provide  Medical  Care. 

Medical  surge 

Medical  supplies  management  and  distribution 

Distribute  Prophylaxis. 

Mass  prophylaxis 

Provide  Mass  Care. 

Mass  care  (sheltering,  feeding,  and  related  services) 

Manage  Fatalities. 

Fatality  management 

68 


Homeland  Security  Strategic  Planning:  Mission  Area  Analysis 


Recover 

MAA/A11  Hazards  Taxonomy 
Function 

Phase  I  &  II  Target  Capabilities 

Provide  Long-Term  Health 

Care. 

Long-term  healthcare 

Provide  Assistance  to  Public. 

Long-term  assistance  for  affected  persons 

Resettlement  and  repatriation  of  affected  persons 

Dispose  of  Materials. 

Debris  and  hazardous  waste  management 

Conduct  Site  Remediation. 

Site  remediation 

Restore  Natural  Resources. 

Natural  resource  restoration 

Restore  Lifelines. 

Restoration  of  lifelines 

Reconstitute  Government 
Services. 

Reconstitution  of  government  services 

Rebuild  Property. 

Structural  damage  and  mitigation  assessment 

Restore  Economy  and 
Institutions. 

Economic  and  community  recovery 

Restoration  of  economy  and  institutions 
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